theory Ipc_C

lemma sendSignal_dequeue_ccorres_helper:
  "ccorres (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_'
           (invs' and st_tcb_at' ((=) (BlockedOnNotification ntfn)) dest
                  and ko_at' nTFN ntfn
                  and K (ntfnObj nTFN = WaitingNtfn (dest # rest))) UNIV hs
           (setNotification ntfn $ ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn
                                        | (a#list) \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN)
        (\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue(Ptr ntfn);;
         \<acute>dest :== head_C \<acute>ntfn_queue;;
         \<acute>ntfn_queue :== CALL tcbEPDequeue(\<acute>dest,\<acute>ntfn_queue);;
         CALL ntfn_ptr_set_queue(Ptr ntfn,\<acute>ntfn_queue);;
         IF head_C \<acute>ntfn_queue = Ptr 0 THEN
             CALL notification_ptr_set_state(Ptr ntfn,scast NtfnState_Idle)
         FI)" apply (rule ccorres_from_vcg) apply (rule allI) apply (rule conseqPre, vcg) apply (clarsimp split del: if_split) apply (frule (2) ntfn_blocked_in_queueD) apply (frule (1) ko_at_valid_ntfn' [OF _ invs_valid_objs']) apply (elim conjE) apply (frule (1) valid_ntfn_isWaitingNtfnD) apply (elim conjE) apply (frule cmap_relation_ntfn) apply (erule (1) cmap_relation_ko_atE) apply (intro conjI) apply (erule h_t_valid_clift) apply (rule impI) apply (rule exI) apply (rule conjI) apply (rule_tac x=\<sigma> in exI) apply (intro conjI) apply assumption+ apply clarsimp apply (drule ntfn_to_ep_queue, (simp add: isWaitingNtfn_def)+) apply (simp add: tcb_queue_relation'_def) apply (clarsimp simp: typ_heap_simps cnotification_relation_def Let_def
                   cong: imp_cong split del: if_split) apply (intro conjI impI allI) apply (fastforce simp: h_t_valid_clift) apply (fastforce simp: h_t_valid_clift)
   \<comment> \<open>empty case\<close> apply clarsimp apply (frule null_ep_queue [simplified comp_def] null_ep_queue) apply (frule iffD1 [OF tcb_queue_head_empty_iff
                          [OF tcb_queue_relation'_queue_rel]]) apply (rule ballI, erule bspec) apply (erule subsetD [rotated]) apply (clarsimp simp: cnotification_relation_def Let_def
                           tcb_queue_relation'_def) apply simp apply (simp add: setNotification_def split_def) apply (rule conjI) apply (rule bexI [OF _ setObject_eq]) apply (simp add: rf_sr_def cstate_relation_def Let_def
                         cpspace_relation_def update_ntfn_map_tos
                         typ_heap_simps') apply (elim conjE) apply (intro conjI)
             \<comment> \<open>tcb relation\<close> apply (erule ctcb_relation_null_queue_ptrs) apply (clarsimp simp: comp_def)
            \<comment> \<open>ep relation\<close> apply (erule iffD1 [OF cmap_relation_cong, OF refl refl, rotated -1]) apply simp apply (rule cendpoint_relation_ntfn_queue [OF invs_sym'], assumption+) apply simp+ apply (erule (1) map_to_ko_atI')
           \<comment> \<open>ntfn relation\<close> apply (rule cpspace_relation_ntfn_update_ntfn, assumption+) apply (simp add: cnotification_relation_def Let_def NtfnState_Idle_def
                             tcb_queue_relation'_def) apply simp
          \<comment> \<open>queue relation\<close> apply (rule cready_queues_relation_null_queue_ptrs, assumption+) apply (clarsimp simp: comp_def) apply (simp add: carch_state_relation_def typ_heap_simps') apply (simp add: cmachine_state_relation_def) apply (simp add: h_t_valid_clift_Some_iff) apply (simp add: objBits_simps') apply (simp add: objBits_simps) apply assumption apply (clarsimp simp: cnotification_relation_def Let_def
                         tcb_queue_relation'_def)
  \<comment> \<open>non-empty case\<close> apply clarsimp apply (frule null_ep_queue [simplified comp_def] null_ep_queue) apply (frule tcb_queue_head_empty_iff [OF tcb_queue_relation'_queue_rel]) apply (rule ballI, erule bspec) apply (erule subsetD [rotated]) apply (clarsimp simp: cnotification_relation_def Let_def
                         tcb_queue_relation'_def) apply (simp add: setNotification_def split_def) apply (rule conjI) apply (rule bexI [OF _ setObject_eq]) apply (frule(1) st_tcb_at_h_t_valid) apply (simp add: rf_sr_def cstate_relation_def Let_def
                        cpspace_relation_def update_ntfn_map_tos
                        typ_heap_simps') apply (elim conjE) apply (intro conjI)
            \<comment> \<open>tcb relation\<close> apply (erule ctcb_relation_null_queue_ptrs) apply (clarsimp simp: comp_def)
           \<comment> \<open>ep relation\<close> apply (erule iffD1 [OF cmap_relation_cong, OF refl refl, rotated -1]) apply simp apply (rule cendpoint_relation_ntfn_queue [OF invs_sym'], assumption+) apply simp+ apply (erule (1) map_to_ko_atI')
          \<comment> \<open>ntfn relation\<close> apply (rule cpspace_relation_ntfn_update_ntfn, assumption+) apply (clarsimp simp: cnotification_relation_def Let_def
                                 isWaitingNtfn_def
                                 tcb_queue_relation'_def valid_ntfn'_def
                          split: Structures_H.notification.splits list.splits
                      split del: if_split) apply (subgoal_tac "tcb_at' (if x22 = [] then x21 else last x22) \<sigma>") apply (clarsimp simp: is_aligned_neg_mask
                           dest!: is_aligned_tcb_ptr_to_ctcb_ptr
                       split del: if_split) apply (clarsimp split: if_split) apply simp
         \<comment> \<open>queue relation\<close> apply (rule cready_queues_relation_null_queue_ptrs, assumption+) apply (clarsimp simp: comp_def) apply (simp add: carch_state_relation_def typ_heap_simps') apply (simp add: cmachine_state_relation_def) apply (simp add: h_t_valid_clift_Some_iff) apply (simp add: objBits_simps') apply (simp add: objBits_simps) apply assumption apply (clarsimp simp: cnotification_relation_def Let_def
                        tcb_queue_relation'_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_' (invs' and st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest and ko_at' nTFN ntfn and K (ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest))) UNIV hs (setNotification ntfn $ ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) (\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr ntfn);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr ntfn,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfn,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI) proof (prove)
goal (1 subgoal):
 1. \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (invs' and st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest and ko_at' nTFN ntfn and K (ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest))) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr ntfn);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr ntfn,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfn,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI {s. \<exists>(rv, \<sigma>')\<in>fst ((setNotification ntfn $ ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dest_' s = tcb_ptr_to_ctcb_ptr dest} proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma>. \<Gamma>\<turnstile> {s. (invs' and st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest and ko_at' nTFN ntfn and K (ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest))) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr ntfn);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr ntfn,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfn,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI {s. \<exists>(rv, \<sigma>')\<in>fst ((setNotification ntfn $ ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dest_' s = tcb_ptr_to_ctcb_ptr dest} proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma>. {s. (invs' and st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest and ko_at' nTFN ntfn and K (ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest))) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn))))) \<longrightarrow> (\<exists>queue. (\<exists>ta. (ta, queue_'_update (\<lambda>_. ret__struct_tcb_queue_C_' t) (tcb_'_update (\<lambda>_. tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn)))))) (dest_'_update (\<lambda>_. tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn)))))) (ntfn_queue_'_update (\<lambda>_. ret__struct_tcb_queue_C_' t) s)))) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb ta) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn)))))) \<in> set queue \<and> ep_queue_relation' (cslift s) queue (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift s (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift s (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift s (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift s (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (Lib.delete (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn))))))) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift s|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift s x)) \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals s))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s)) \<longrightarrow> s \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift s (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift s (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift s (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift s (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift s (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift s (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift s (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((setNotification ntfn $ ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). (\<sigma>', s\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))) \<and> ((if tcbEPPrev_C (the (cslift s (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift s (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((setNotification ntfn $ ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). (\<sigma>', s\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))))))} proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; dest \<in> set (ntfnQueue (ntfnObj nTFN)) \<and> isWaitingNtfn (ntfnObj nTFN)\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; dest \<in> set (ntfnQueue (ntfnObj nTFN)) \<and> isWaitingNtfn (ntfnObj nTFN); valid_ntfn' nTFN \<sigma>\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN)\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> [] \<and> (\<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>) \<and> distinct (ntfnQueue (ntfnObj nTFN))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest)))))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn
 2. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'\<rbrakk> \<Longrightarrow> (\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'\<rbrakk> \<Longrightarrow> (\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> \<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest)))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set (?queue120 \<sigma> x ko'). tcb_at' tcb t) \<and> distinct (?queue120 \<sigma> x ko') \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<in> set (?queue120 \<sigma> x ko') \<and> ep_queue_relation' (cslift x) (?queue120 \<sigma> x ko') (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (?queue120 \<sigma> x ko')) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue120 \<sigma> x ko'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue120 \<sigma> x ko'))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest)))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> \<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set (?queue120 \<sigma> x ko'). tcb_at' tcb t) \<and> distinct (?queue120 \<sigma> x ko') \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<in> set (?queue120 \<sigma> x ko') \<and> ep_queue_relation' (cslift x) (?queue120 \<sigma> x ko') (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))
 2. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (?queue120 \<sigma> x ko')) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue120 \<sigma> x ko'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue120 \<sigma> x ko'))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> (\<sigma>, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set (?queue120 \<sigma> x ko'). tcb_at' tcb \<sigma>) \<and> distinct (?queue120 \<sigma> x ko') \<and> ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<in> set (?queue120 \<sigma> x ko') \<and> ep_queue_relation' (cslift x) (?queue120 \<sigma> x ko') (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))
 2. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (?queue120 \<sigma> x ko')) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue120 \<sigma> x ko'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue120 \<sigma> x ko'))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))) proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> (\<sigma>, x) \<in> rf_sr
 2. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> \<forall>tcb\<in>set (?queue120 \<sigma> x ko'). tcb_at' tcb \<sigma>
 3. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> distinct (?queue120 \<sigma> x ko')
 4. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<in> set (?queue120 \<sigma> x ko')
 5. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift x) (?queue120 \<sigma> x ko') (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))
 6. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (?queue120 \<sigma> x ko')) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue120 \<sigma> x ko'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue120 \<sigma> x ko'))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<in> set (ntfnQueue (ntfnObj nTFN))
 2. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift x) (ntfnQueue (ntfnObj nTFN)) (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))
 3. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x ko' t. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) \<notin> set rest\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest
 2. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift x) (ntfnQueue (ntfnObj nTFN)) (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))
 3. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x ko' t. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) \<notin> set rest; ep_queue_relation' (cslift x) (dest # rest) (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')))\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest
 2. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift x) (ntfnQueue (ntfnObj nTFN)) (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))
 3. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift x) (ntfnQueue (ntfnObj nTFN)) (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))
 2. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest))) proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x ko' t. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn
 2. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL\<rbrakk> \<Longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn
 3. \<And>\<sigma> x ko' t ta tb. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; \<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest
 4. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL\<rbrakk> \<Longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn
 2. \<And>\<sigma> x ko' t ta tb. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; \<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest
 3. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; \<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest
 2. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) NULL (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest
 2. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) NULL (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest
 2. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) NULL (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> \<forall>td\<in>set (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest). tcb_at' td (?s218 \<sigma> x ko' t ta tb tc ntfn' notification)
 2. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) NULL (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> NULL = NULL
 3. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) NULL (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest
 4. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification td. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) NULL (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); td \<in> set (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest)\<rbrakk> \<Longrightarrow> td \<in> set rest
 2. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) NULL (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> NULL = NULL
 3. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) NULL (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest
 4. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification td. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) NULL (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> set (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<subseteq> set rest
 2. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) NULL (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> NULL = NULL
 3. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) NULL (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest
 4. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) NULL (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> NULL = NULL
 2. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) NULL (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest
 3. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) NULL (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest
 2. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> (\<exists>xa\<in>fst (setObject ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). (snd xa, x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr) \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest
 2. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setObject ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). (snd xa, x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest
 3. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> (snd ((), \<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfn \<mapsto> injectKOS (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN))\<rparr>), x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb tc ntfn' notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P232 \<sigma> x ko' t ta tb tc ntfn' notification) ntfn \<sigma>
 6. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest
 7. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)) \<and> cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation \<and> cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr \<and> carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>) \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>) \<and> ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<and> ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>) \<and> cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState \<sigma>) (globals x) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x) \<and> cte_array_relation \<sigma> (globals x) \<and> tcb_cte_array_relation \<sigma> (globals x) \<and> apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>) \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>) \<and> ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma> \<and> x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr \<and> {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs \<and> x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr \<and> {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs \<and> htd_safe domain (hrs_htd (t_hrs_' (globals x))) \<and> - domain \<subseteq> kernel_data_refs \<and> globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list \<and> cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule \<and> ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>) \<and> ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>) \<and> ksDomainTime_' (globals x) = ksDomainTime \<sigma>; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift t) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift t)) \<and> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN)))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> notification)) ntfn_Ptr (cnotification_relation (cslift t)) \<and> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb tc ntfn' notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P232 \<sigma> x ko' t ta tb tc ntfn' notification) ntfn \<sigma>
 6. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest
 7. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift t) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift t)) \<and> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN)))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> notification)) ntfn_Ptr (cnotification_relation (cslift t)) \<and> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb tc ntfn' notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P232 \<sigma> x ko' t ta tb tc ntfn' notification) ntfn \<sigma>
 6. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest
 7. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (12 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift t) tcb_ptr_to_ctcb_ptr ctcb_relation
 2. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN)))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> notification)) ntfn_Ptr (cnotification_relation (cslift t))
 4. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb tc ntfn' notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P232 \<sigma> x ko' t ta tb tc ntfn' notification) ntfn \<sigma>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> map_option tcb_null_queue_ptrs \<circ> cslift t = map_option tcb_null_queue_ptrs \<circ> cslift x
 2. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN)))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> notification)) ntfn_Ptr (cnotification_relation (cslift t))
 4. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb tc ntfn' notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P232 \<sigma> x ko' t ta tb tc ntfn' notification) ntfn \<sigma>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift t))
 2. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN)))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> notification)) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc ntfn' notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P232 \<sigma> x ko' t ta tb tc ntfn' notification) ntfn \<sigma>
 10. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; map_to_eps (ksPSpace \<sigma>) p = Some a; map_to_eps (ksPSpace \<sigma>) p = Some a'; cslift x (ep_Ptr p) = Some b; cslift x (ep_Ptr p) = Some b'\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift x) a b = cendpoint_relation (cslift t) a' b'
 2. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN)))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> notification)) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc ntfn' notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P232 \<sigma> x ko' t ta tb tc ntfn' notification) ntfn \<sigma>
 10. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift x) a b = cendpoint_relation (cslift t) a b
 2. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN)))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> notification)) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc ntfn' notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P232 \<sigma> x ko' t ta tb tc ntfn' notification) ntfn \<sigma>
 10. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> isWaitingNtfn (ntfnObj nTFN)
 2. \<And>\<sigma> x ko' t ta tb tc ntfn' notification p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb tc ntfn' notification p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?epptr287 \<sigma> x ko' t ta tb tc ntfn' notification p a a' b b') \<sigma>
 4. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN)))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> notification)) ntfn_Ptr (cnotification_relation (cslift t))
 5. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 6. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>)
 8. \<And>\<sigma> x ko' t ta tb tc ntfn' notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 9. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 10. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
A total of 13 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?epptr287 \<sigma> x ko' t ta tb tc ntfn' notification p a a b b) \<sigma>
 2. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN)))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> notification)) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc ntfn' notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P232 \<sigma> x ko' t ta tb tc ntfn' notification) ntfn \<sigma>
 10. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN)))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> notification)) ntfn_Ptr (cnotification_relation (cslift t))
 2. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc ntfn' notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P232 \<sigma> x ko' t ta tb tc ntfn' notification) ntfn \<sigma>
 9. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest
 10. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cnotification_relation (cslift t) (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) notification
 2. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj nTFN) then set (ntfnQueue (ntfnObj nTFN)) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj nTFN) then set (ntfnQueue (ntfnObj nTFN)) else {}))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc ntfn' notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P232 \<sigma> x ko' t ta tb tc ntfn' notification) ntfn \<sigma>
 10. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj nTFN) then set (ntfnQueue (ntfnObj nTFN)) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj nTFN) then set (ntfnQueue (ntfnObj nTFN)) else {}))\<^esub>
 2. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc ntfn' notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P232 \<sigma> x ko' t ta tb tc ntfn' notification) ntfn \<sigma>
 9. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest
 10. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 2. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb tc ntfn' notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P232 \<sigma> x ko' t ta tb tc ntfn' notification) ntfn \<sigma>
 8. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest
 9. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> map_option tcb_null_ep_ptrs \<circ> cslift t = map_option tcb_null_ep_ptrs \<circ> cslift x
 2. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb tc ntfn' notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P232 \<sigma> x ko' t ta tb tc ntfn' notification) ntfn \<sigma>
 8. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest
 9. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb tc ntfn' notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 4. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 5. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 6. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P232 \<sigma> x ko' t ta tb tc ntfn' notification) ntfn \<sigma>
 7. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest
 8. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb tc ntfn' notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P232 \<sigma> x ko' t ta tb tc ntfn' notification) ntfn \<sigma>
 6. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest
 7. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 2. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 3. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 4. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P232 \<sigma> x ko' t ta tb tc ntfn' notification) ntfn \<sigma>
 5. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest
 6. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 2. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 3. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P232 \<sigma> x ko' t ta tb tc ntfn' notification) ntfn \<sigma>
 4. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest
 5. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 2. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P232 \<sigma> x ko' t ta tb tc ntfn' notification) ntfn \<sigma>
 3. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest
 4. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> obj_at' (?P232 \<sigma> x ko' t ta tb tc ntfn' notification) ntfn \<sigma>
 2. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest
 3. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc ntfn' notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = NULL; head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); notification_lift notification = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = NULL; (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = []\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest
 2. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; dest \<in> set (ntfnQueue (ntfnObj nTFN)); isWaitingNtfn (ntfnObj nTFN); ntfnQueue (ntfnObj nTFN) \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj nTFN)). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj nTFN)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) (ntfnQueue (ntfnObj nTFN))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> \<forall>tc\<in>set (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest). tcb_at' tc (?s327 \<sigma> x ko' t ta tb ntfn')
 2. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL) = ((if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = [])\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn' tc. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; tcb_at' dest \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); tc \<in> set (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest)\<rbrakk> \<Longrightarrow> tc \<in> set rest
 2. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL) = ((if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = [])\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn' tc. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; tcb_at' dest \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> set (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<subseteq> set rest
 2. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL) = ((if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = [])\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ((if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL) = ((if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) = [])\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> (\<exists>xa\<in>fst (setObject ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). (snd xa, x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr) \<and> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setObject ntfn (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) \<sigma>). (snd xa, x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> (snd ((), \<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfn \<mapsto> injectKOS (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN))\<rparr>), x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb ntfn' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb ntfn' v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb ntfn' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P340 \<sigma> x ko' t ta tb ntfn') ntfn \<sigma>
 6. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest\<rbrakk> \<Longrightarrow> (snd ((), \<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfn \<mapsto> injectKOS (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN))\<rparr>), x\<lparr>dest_' := tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')), ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb ntfn' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb ntfn' v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb ntfn' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P340 \<sigma> x ko' t ta tb ntfn') ntfn \<sigma>
 6. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)) \<and> cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation \<and> cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr \<and> carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>) \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>) \<and> ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<and> ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>) \<and> cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState \<sigma>) (globals x) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x) \<and> cte_array_relation \<sigma> (globals x) \<and> tcb_cte_array_relation \<sigma> (globals x) \<and> apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>) \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>) \<and> ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma> \<and> x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr \<and> {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs \<and> x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr \<and> {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs \<and> htd_safe domain (hrs_htd (t_hrs_' (globals x))) \<and> - domain \<subseteq> kernel_data_refs \<and> globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list \<and> cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule \<and> ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>) \<and> ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>) \<and> ksDomainTime_' (globals x) = ksDomainTime \<sigma>; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift t) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift t)) \<and> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN)))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t)) \<and> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb ntfn' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb ntfn' v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb ntfn' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P340 \<sigma> x ko' t ta tb ntfn') ntfn \<sigma>
 6. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift t) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift t)) \<and> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN)))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t)) \<and> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb ntfn' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb ntfn' v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb ntfn' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P340 \<sigma> x ko' t ta tb ntfn') ntfn \<sigma>
 6. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift t) tcb_ptr_to_ctcb_ptr ctcb_relation
 2. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN)))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 4. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb ntfn' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb ntfn' v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb ntfn' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P340 \<sigma> x ko' t ta tb ntfn') ntfn \<sigma>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> map_option tcb_null_queue_ptrs \<circ> cslift t = map_option tcb_null_queue_ptrs \<circ> cslift x
 2. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN)))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 4. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb ntfn' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb ntfn' v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb ntfn' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P340 \<sigma> x ko' t ta tb ntfn') ntfn \<sigma>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift t))
 2. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN)))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb ntfn' v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb ntfn' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P340 \<sigma> x ko' t ta tb ntfn') ntfn \<sigma>
 10. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn' p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; map_to_eps (ksPSpace \<sigma>) p = Some a; map_to_eps (ksPSpace \<sigma>) p = Some a'; cslift x (ep_Ptr p) = Some b; cslift x (ep_Ptr p) = Some b'\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift x) a b = cendpoint_relation (cslift t) a' b'
 2. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN)))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb ntfn' v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb ntfn' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P340 \<sigma> x ko' t ta tb ntfn') ntfn \<sigma>
 10. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn' p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift x) a b = cendpoint_relation (cslift t) a b
 2. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN)))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb ntfn' v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb ntfn' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P340 \<sigma> x ko' t ta tb ntfn') ntfn \<sigma>
 10. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (12 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn' p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> isWaitingNtfn (ntfnObj nTFN)
 2. \<And>\<sigma> x ko' t ta tb ntfn' p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj nTFN)))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb ntfn' p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?epptr398 \<sigma> x ko' t ta tb ntfn' p a a' b b') \<sigma>
 4. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN)))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 5. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 6. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 8. \<And>\<sigma> x ko' t ta tb ntfn' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 9. \<And>\<sigma> x ko' t ta tb ntfn' v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 10. \<And>\<sigma> x ko' t ta tb ntfn' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
A total of 12 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn' p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?epptr398 \<sigma> x ko' t ta tb ntfn' p a a b b) \<sigma>
 2. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN)))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb ntfn' v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb ntfn' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P340 \<sigma> x ko' t ta tb ntfn') ntfn \<sigma>
 10. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN)))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 2. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ntfn' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb ntfn' v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb ntfn' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P340 \<sigma> x ko' t ta tb ntfn') ntfn \<sigma>
 9. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cnotification_relation (cslift t) (ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) nTFN) ntfn'
 2. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj nTFN) then set (ntfnQueue (ntfnObj nTFN)) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj nTFN) then set (ntfnQueue (ntfnObj nTFN)) else {}))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb ntfn' v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb ntfn' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P340 \<sigma> x ko' t ta tb ntfn') ntfn \<sigma>
 10. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn' x21 x22 tcb tcba tcbb. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # x21 # x22); cslift x (ntfn_Ptr ntfn) = Some ko'; tcb_at' dest \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr x21; head_C (ret__struct_tcb_queue_C_' tb) = tcb_ptr_to_ctcb_ptr dest; StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr x21) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22)) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (insert (tcb_ptr_to_ctcb_ptr x21) (tcb_ptr_to_ctcb_ptr ` set x22)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (insert (tcb_ptr_to_ctcb_ptr x21) (tcb_ptr_to_ctcb_ptr ` set x22)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); tcb_ptr_to_ctcb_ptr x21 \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; case ntfnBoundTCB nTFN of None \<Rightarrow> True | Some tcb \<Rightarrow> dest # x21 # x22 = [tcb]; valid_bound_tcb' (ntfnBoundTCB nTFN) \<sigma>; notification_CL.state_CL (notification_lift ko') = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting; tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22); tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest; option_to_ctcb_ptr (ntfnBoundTCB nTFN) = tcb_Ptr (ntfnBoundTCB_CL (notification_lift ko')); cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; tcbEPPrev_C tcb = NULL; rest = x21 # x22; tcb_at' x21 \<sigma>; \<forall>t\<in>set x22. tcb_at' t \<sigma>; dest \<noteq> x21; dest \<notin> set x22; x21 \<notin> set x22; distinct x22; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr x21; cslift t (tcb_ptr_to_ctcb_ptr x21) = Some tcba; cslift x (tcb_ptr_to_ctcb_ptr x21) = Some tcbb; tcbEPPrev_C tcba = NULL; ep_queue_relation (cslift t) x22 (tcb_ptr_to_ctcb_ptr x21) (tcbEPNext_C tcba); tcbEPPrev_C tcbb = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) x22 (tcb_ptr_to_ctcb_ptr x21) (tcbEPNext_C tcbb)\<rbrakk> \<Longrightarrow> tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22)) && ~~ mask 4) = tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22) \<and> tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr x21) && ~~ mask 4) = tcb_ptr_to_ctcb_ptr x21 \<and> (\<exists>tcb. cslift t (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr x21) && ~~ mask 4)) = Some tcb \<and> tcbEPPrev_C tcb = NULL \<and> ep_queue_relation (cslift t) x22 (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr x21) && ~~ mask 4)) (tcbEPNext_C tcb))
 2. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj nTFN) then set (ntfnQueue (ntfnObj nTFN)) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj nTFN) then set (ntfnQueue (ntfnObj nTFN)) else {}))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb ntfn' v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb ntfn' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P340 \<sigma> x ko' t ta tb ntfn') ntfn \<sigma>
 10. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn' x21 x22 tcb tcba tcbb. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # x21 # x22); cslift x (ntfn_Ptr ntfn) = Some ko'; tcb_at' dest \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr x21; head_C (ret__struct_tcb_queue_C_' tb) = tcb_ptr_to_ctcb_ptr dest; StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr x21) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22)) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (insert (tcb_ptr_to_ctcb_ptr x21) (tcb_ptr_to_ctcb_ptr ` set x22)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (insert (tcb_ptr_to_ctcb_ptr x21) (tcb_ptr_to_ctcb_ptr ` set x22)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); tcb_ptr_to_ctcb_ptr x21 \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; case ntfnBoundTCB nTFN of None \<Rightarrow> True | Some tcb \<Rightarrow> dest # x21 # x22 = [tcb]; valid_bound_tcb' (ntfnBoundTCB nTFN) \<sigma>; notification_CL.state_CL (notification_lift ko') = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting; tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22); tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest; option_to_ctcb_ptr (ntfnBoundTCB nTFN) = tcb_Ptr (ntfnBoundTCB_CL (notification_lift ko')); cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; tcbEPPrev_C tcb = NULL; rest = x21 # x22; tcb_at' x21 \<sigma>; \<forall>t\<in>set x22. tcb_at' t \<sigma>; dest \<noteq> x21; dest \<notin> set x22; x21 \<notin> set x22; distinct x22; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr x21; cslift t (tcb_ptr_to_ctcb_ptr x21) = Some tcba; cslift x (tcb_ptr_to_ctcb_ptr x21) = Some tcbb; tcbEPPrev_C tcba = NULL; ep_queue_relation (cslift t) x22 (tcb_ptr_to_ctcb_ptr x21) (tcbEPNext_C tcba); tcbEPPrev_C tcbb = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) x22 (tcb_ptr_to_ctcb_ptr x21) (tcbEPNext_C tcbb); tcb_at' (if x22 = [] then x21 else last x22) \<sigma>\<rbrakk> \<Longrightarrow> tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22)) && ~~ mask 4) = tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22) \<and> tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr x21) && ~~ mask 4) = tcb_ptr_to_ctcb_ptr x21 \<and> (\<exists>tcb. cslift t (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr x21) && ~~ mask 4)) = Some tcb \<and> tcbEPPrev_C tcb = NULL \<and> ep_queue_relation (cslift t) x22 (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr x21) && ~~ mask 4)) (tcbEPNext_C tcb))
 2. \<And>\<sigma> x ko' t ta tb ntfn' x21 x22 tcb tcba tcbb. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # x21 # x22); cslift x (ntfn_Ptr ntfn) = Some ko'; tcb_at' dest \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr x21; head_C (ret__struct_tcb_queue_C_' tb) = tcb_ptr_to_ctcb_ptr dest; StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr x21) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22)) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (insert (tcb_ptr_to_ctcb_ptr x21) (tcb_ptr_to_ctcb_ptr ` set x22)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (insert (tcb_ptr_to_ctcb_ptr x21) (tcb_ptr_to_ctcb_ptr ` set x22)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); tcb_ptr_to_ctcb_ptr x21 \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; case ntfnBoundTCB nTFN of None \<Rightarrow> True | Some tcb \<Rightarrow> dest # x21 # x22 = [tcb]; valid_bound_tcb' (ntfnBoundTCB nTFN) \<sigma>; notification_CL.state_CL (notification_lift ko') = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting; tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22); tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest; option_to_ctcb_ptr (ntfnBoundTCB nTFN) = tcb_Ptr (ntfnBoundTCB_CL (notification_lift ko')); cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; tcbEPPrev_C tcb = NULL; rest = x21 # x22; tcb_at' x21 \<sigma>; \<forall>t\<in>set x22. tcb_at' t \<sigma>; dest \<noteq> x21; dest \<notin> set x22; x21 \<notin> set x22; distinct x22; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr x21; cslift t (tcb_ptr_to_ctcb_ptr x21) = Some tcba; cslift x (tcb_ptr_to_ctcb_ptr x21) = Some tcbb; tcbEPPrev_C tcba = NULL; ep_queue_relation (cslift t) x22 (tcb_ptr_to_ctcb_ptr x21) (tcbEPNext_C tcba); tcbEPPrev_C tcbb = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) x22 (tcb_ptr_to_ctcb_ptr x21) (tcbEPNext_C tcbb)\<rbrakk> \<Longrightarrow> tcb_at' (if x22 = [] then x21 else last x22) \<sigma>
 3. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj nTFN) then set (ntfnQueue (ntfnObj nTFN)) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj nTFN) then set (ntfnQueue (ntfnObj nTFN)) else {}))\<^esub>
 4. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb ntfn' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb ntfn' v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb ntfn' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P340 \<sigma> x ko' t ta tb ntfn') ntfn \<sigma>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn' x21 x22 tcb tcba tcbb. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # x21 # x22); cslift x (ntfn_Ptr ntfn) = Some ko'; tcb_at' dest \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr x21; head_C (ret__struct_tcb_queue_C_' tb) = tcb_ptr_to_ctcb_ptr dest; StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr x21) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22)) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (insert (tcb_ptr_to_ctcb_ptr x21) (tcb_ptr_to_ctcb_ptr ` set x22)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (insert (tcb_ptr_to_ctcb_ptr x21) (tcb_ptr_to_ctcb_ptr ` set x22)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); tcb_ptr_to_ctcb_ptr x21 \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; case ntfnBoundTCB nTFN of None \<Rightarrow> True | Some tcb \<Rightarrow> dest # x21 # x22 = [tcb]; valid_bound_tcb' (ntfnBoundTCB nTFN) \<sigma>; notification_CL.state_CL (notification_lift ko') = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting; tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr (if x22 = [] then x21 else last x22); tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest; option_to_ctcb_ptr (ntfnBoundTCB nTFN) = tcb_Ptr (ntfnBoundTCB_CL (notification_lift ko')); cslift x (tcb_ptr_to_ctcb_ptr dest) = Some tcb; tcbEPPrev_C tcb = NULL; rest = x21 # x22; tcb_at' x21 \<sigma>; \<forall>t\<in>set x22. tcb_at' t \<sigma>; dest \<noteq> x21; dest \<notin> set x22; x21 \<notin> set x22; distinct x22; tcbEPNext_C tcb = tcb_ptr_to_ctcb_ptr x21; cslift t (tcb_ptr_to_ctcb_ptr x21) = Some tcba; cslift x (tcb_ptr_to_ctcb_ptr x21) = Some tcbb; tcbEPPrev_C tcba = NULL; ep_queue_relation (cslift t) x22 (tcb_ptr_to_ctcb_ptr x21) (tcbEPNext_C tcba); tcbEPPrev_C tcbb = tcb_ptr_to_ctcb_ptr dest; ep_queue_relation (cslift x) x22 (tcb_ptr_to_ctcb_ptr x21) (tcbEPNext_C tcbb)\<rbrakk> \<Longrightarrow> tcb_at' (if x22 = [] then x21 else last x22) \<sigma>
 2. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj nTFN) then set (ntfnQueue (ntfnObj nTFN)) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj nTFN) then set (ntfnQueue (ntfnObj nTFN)) else {}))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb ntfn' v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb ntfn' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P340 \<sigma> x ko' t ta tb ntfn') ntfn \<sigma>
 10. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj nTFN) then set (ntfnQueue (ntfnObj nTFN)) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj nTFN) then set (ntfnQueue (ntfnObj nTFN)) else {}))\<^esub>
 2. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ntfn' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb ntfn' v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb ntfn' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P340 \<sigma> x ko' t ta tb ntfn') ntfn \<sigma>
 9. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 2. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ntfn' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>\<sigma> x ko' t ta tb ntfn' v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>\<sigma> x ko' t ta tb ntfn' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P340 \<sigma> x ko' t ta tb ntfn') ntfn \<sigma>
 8. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> map_option tcb_null_ep_ptrs \<circ> cslift t = map_option tcb_null_ep_ptrs \<circ> cslift x
 2. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ntfn' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>\<sigma> x ko' t ta tb ntfn' v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>\<sigma> x ko' t ta tb ntfn' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P340 \<sigma> x ko' t ta tb ntfn') ntfn \<sigma>
 8. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb ntfn' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 4. \<And>\<sigma> x ko' t ta tb ntfn' v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 5. \<And>\<sigma> x ko' t ta tb ntfn' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 6. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P340 \<sigma> x ko' t ta tb ntfn') ntfn \<sigma>
 7. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb ntfn' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb ntfn' v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb ntfn' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P340 \<sigma> x ko' t ta tb ntfn') ntfn \<sigma>
 6. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn' val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 2. \<And>\<sigma> x ko' t ta tb ntfn' v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 3. \<And>\<sigma> x ko' t ta tb ntfn' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 4. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P340 \<sigma> x ko' t ta tb ntfn') ntfn \<sigma>
 5. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn' v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 2. \<And>\<sigma> x ko' t ta tb ntfn' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 3. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P340 \<sigma> x ko' t ta tb ntfn') ntfn \<sigma>
 4. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn' v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 2. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P340 \<sigma> x ko' t ta tb ntfn') ntfn \<sigma>
 3. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P340 \<sigma> x ko' t ta tb ntfn') ntfn \<sigma>
 2. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb ntfn'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) dest \<sigma>; ko_at' nTFN ntfn \<sigma>; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn (dest # rest); (\<sigma>, x) \<in> rf_sr; valid_ntfn' nTFN \<sigma>; isWaitingNtfn (Structures_H.ntfn.WaitingNtfn (dest # rest)); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) nTFN ko'; (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) \<noteq> []; tcb_at' dest \<sigma>; \<forall>t\<in>set rest. tcb_at' t \<sigma>; dest \<notin> set rest; distinct rest; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); head_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tb) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift ntfn' = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift t) (if ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) = dest then rest else dest # remove1 (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')))) rest) (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr dest) (tcb_ptr_to_ctcb_ptr ` set rest))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))))) = NULL then tcbEPNext_C (the (cslift x (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) = tcb_ptr_to_ctcb_ptr dest proof (prove)
goal:
No subgoals!