theory IpcCancel_C

lemma cancelSignal_ccorres_helper:
  "ccorres dc xfdc (invs' and st_tcb_at' ((=) (BlockedOnNotification ntfn)) thread and ko_at' ntfn' ntfn)
        UNIV
        []
        (setNotification ntfn (ntfnObj_update
          (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = []
           then ntfn.IdleNtfn
           else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn'))
        (\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue(Ptr ntfn);;
         \<acute>ntfn_queue :== CALL tcbEPDequeue(tcb_ptr_to_ctcb_ptr thread,\<acute>ntfn_queue);;
         CALL ntfn_ptr_set_queue(Ptr ntfn,\<acute>ntfn_queue);;
         IF head_C \<acute>ntfn_queue = NULL THEN
           CALL notification_ptr_set_state(Ptr ntfn,
           scast NtfnState_Idle)
         FI)" apply (rule ccorres_from_vcg) apply (rule allI, rule conseqPre, vcg) apply (clarsimp split del: if_split simp del: comp_def) apply (frule (2) ntfn_blocked_in_queueD) apply (frule (1) ko_at_valid_ntfn' [OF _ invs_valid_objs']) apply (elim conjE) apply (frule (1) valid_ntfn_isWaitingNtfnD) apply (elim conjE) apply (frule cmap_relation_ntfn) apply (erule (1) cmap_relation_ko_atE) apply (rule conjI) apply (erule h_t_valid_clift) apply (rule impI) apply (rule exI) apply (rule conjI) apply (rule_tac x = \<sigma> in exI) apply (intro conjI, assumption+) apply (drule (2) ntfn_to_ep_queue) apply (simp add: tcb_queue_relation'_def) apply (clarsimp simp: typ_heap_simps cong: imp_cong split del: if_split simp del: comp_def) apply (frule null_ep_queue [simplified Fun.comp_def]) apply (intro impI conjI allI)
   \<comment> \<open>empty case\<close> apply clarsimp apply (frule iffD1 [OF tcb_queue_head_empty_iff [OF tcb_queue_relation'_queue_rel]]) apply (rule ballI, erule bspec) apply (erule subsetD [rotated]) apply clarsimp apply simp apply (simp add: setNotification_def split_def) apply (rule bexI [OF _ setObject_eq]) apply (simp add: remove1_empty  rf_sr_def cstate_relation_def Let_def
                        cpspace_relation_def update_ntfn_map_tos
                        typ_heap_simps') apply (elim conjE) apply (intro conjI)
            \<comment> \<open>tcb relation\<close> apply (erule ctcb_relation_null_queue_ptrs) apply (clarsimp simp: comp_def)
           \<comment> \<open>ep relation\<close> apply (erule iffD1 [OF cmap_relation_cong, OF refl refl, rotated -1]) apply simp apply (rule cendpoint_relation_ntfn_queue [OF invs_sym'], assumption+) apply simp apply (erule (1) map_to_ko_atI')
          \<comment> \<open>ntfn relation\<close> apply (rule cpspace_relation_ntfn_update_ntfn, assumption+) apply (simp add: cnotification_relation_def Let_def NtfnState_Idle_def) apply (simp add: carch_state_relation_def carch_globals_def)
         \<comment> \<open>queue relation\<close> apply (rule cready_queues_relation_null_queue_ptrs, assumption+) apply (clarsimp simp: comp_def) apply (simp add: carch_state_relation_def carch_globals_def
                         typ_heap_simps') apply (simp add: cmachine_state_relation_def) apply (simp add: h_t_valid_clift_Some_iff) apply (simp add: objBits_simps') apply (simp add: objBits_simps) apply assumption

  \<comment> \<open>non empty case\<close> apply (frule tcb_queue_head_empty_iff [OF tcb_queue_relation'_queue_rel]) apply (rule ballI, erule bspec) apply (erule subsetD [rotated]) apply clarsimp apply (simp add: setNotification_def split_def) apply (rule bexI [OF _ setObject_eq]) apply (frule (1) st_tcb_at_h_t_valid) apply (simp add: remove1_empty rf_sr_def cstate_relation_def Let_def
                       cpspace_relation_def update_ntfn_map_tos
                       typ_heap_simps') apply (elim conjE) apply (intro conjI)
           \<comment> \<open>tcb relation\<close> apply (erule ctcb_relation_null_queue_ptrs) apply (clarsimp simp: comp_def)
          \<comment> \<open>ep relation\<close> apply (erule iffD1 [OF cmap_relation_cong, OF refl refl, rotated -1]) apply simp apply (rule cendpoint_relation_ntfn_queue) apply fastforce apply assumption+ apply simp apply (erule (1) map_to_ko_atI')
         \<comment> \<open>ntfn relation\<close> apply (rule cpspace_relation_ntfn_update_ntfn, assumption+) apply (simp add: cnotification_relation_def Let_def isWaitingNtfn_def
                    split: ntfn.splits split del: if_split) apply (erule iffD1 [OF tcb_queue_relation'_cong [OF refl _ _ refl], rotated -1]) apply (clarsimp simp add: Ptr_ptr_val h_t_valid_clift_Some_iff) apply (simp add: tcb_queue_relation'_next_mask) apply (clarsimp simp add: Ptr_ptr_val h_t_valid_clift_Some_iff) apply (simp add: tcb_queue_relation'_prev_mask) apply simp
        \<comment> \<open>queue relation\<close> apply (rule cready_queues_relation_null_queue_ptrs, assumption+) apply (clarsimp simp: comp_def) apply (simp add: carch_state_relation_def carch_globals_def
                        typ_heap_simps') apply (simp add: cmachine_state_relation_def) apply (simp add: h_t_valid_clift_Some_iff) apply (simp add: objBits_simps') apply (simp add: objBits_simps) apply assumption done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (invs' and st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread and ko_at' ntfn' ntfn) UNIV [] (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn')) (\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr ntfn);;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr ntfn,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfn,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI) proof (prove)
goal (1 subgoal):
 1. \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (invs' and st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread and ko_at' ntfn' ntfn) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr ntfn);;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr ntfn,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfn,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI {s. \<exists>(rv, \<sigma>')\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)} proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma>. {s. (invs' and st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread and ko_at' ntfn' ntfn) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn))))) \<longrightarrow> (\<exists>queue. (\<exists>ta. (ta, queue_'_update (\<lambda>_. ret__struct_tcb_queue_C_' t) (tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfn_queue_'_update (\<lambda>_. ret__struct_tcb_queue_C_' t) s))) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb ta) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread) \<in> set queue \<and> ep_queue_relation' (cslift s) queue (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (Lib.delete (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread)) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift s|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift s x)) \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals s))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s)) \<longrightarrow> s \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift s (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). (\<sigma>', s\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> dc rv (xfdc (s\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>))))) \<and> ((if tcbEPPrev_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). (\<sigma>', s\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> dc rv (xfdc (s\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>))))))))} proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> thread \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; thread \<in> set (ntfnQueue (ntfnObj ntfn')) \<and> isWaitingNtfn (ntfnObj ntfn')\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> thread \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; thread \<in> set (ntfnQueue (ntfnObj ntfn')) \<and> isWaitingNtfn (ntfnObj ntfn'); valid_ntfn' ntfn' \<sigma>\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> thread \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn')\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> thread \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> [] \<and> (\<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>) \<and> distinct (ntfnQueue (ntfnObj ntfn'))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> thread \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn'))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> thread \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> thread \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> thread \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)))))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn
 2. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'\<rbrakk> \<Longrightarrow> (\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> thread \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'\<rbrakk> \<Longrightarrow> (\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> thread \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> \<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> thread \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set (?queue118 \<sigma> x ko'). tcb_at' tcb t) \<and> distinct (?queue118 \<sigma> x ko') \<and> thread \<in> set (?queue118 \<sigma> x ko') \<and> ep_queue_relation' (cslift x) (?queue118 \<sigma> x ko') (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread (?queue118 \<sigma> x ko')) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue118 \<sigma> x ko'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue118 \<sigma> x ko'))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> \<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set (?queue118 \<sigma> x ko'). tcb_at' tcb t) \<and> distinct (?queue118 \<sigma> x ko') \<and> thread \<in> set (?queue118 \<sigma> x ko') \<and> ep_queue_relation' (cslift x) (?queue118 \<sigma> x ko') (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))
 2. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread (?queue118 \<sigma> x ko')) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue118 \<sigma> x ko'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue118 \<sigma> x ko'))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> (\<sigma>, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set (?queue118 \<sigma> x ko'). tcb_at' tcb \<sigma>) \<and> distinct (?queue118 \<sigma> x ko') \<and> thread \<in> set (?queue118 \<sigma> x ko') \<and> ep_queue_relation' (cslift x) (?queue118 \<sigma> x ko') (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))
 2. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread (?queue118 \<sigma> x ko')) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue118 \<sigma> x ko'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue118 \<sigma> x ko'))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift x) (ntfnQueue (ntfnObj ntfn')) (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))
 2. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))); ep_queue_relation' (cslift x) (ntfnQueue (ntfnObj ntfn')) (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift x) (ntfnQueue (ntfnObj ntfn')) (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))))
 2. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>ta. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift x (ntfn_Ptr ntfn)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfn \<and> (\<forall>tb. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfn)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rbrakk> \<Longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL \<longrightarrow> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; \<exists>notification. notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tc)\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) NULL (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rbrakk> \<Longrightarrow> (remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>\<rparr>) \<in> rf_sr)) \<and> (remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> [] \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>\<rparr>) \<in> rf_sr))
 2. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) NULL (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rbrakk> \<Longrightarrow> \<forall>td\<in>set (remove1 thread (ntfnQueue (ntfnObj ntfn'))). tcb_at' td (?s169 \<sigma> x ko' t ta tb ntfn'a tc notification)
 2. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) NULL (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rbrakk> \<Longrightarrow> NULL = NULL
 3. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) NULL (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> (remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>\<rparr>) \<in> rf_sr)) \<and> (remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> [] \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>\<rparr>) \<in> rf_sr))
 4. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification td. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) NULL (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); td \<in> set (remove1 thread (ntfnQueue (ntfnObj ntfn')))\<rbrakk> \<Longrightarrow> td \<in> set (ntfnQueue (ntfnObj ntfn'))
 2. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) NULL (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rbrakk> \<Longrightarrow> NULL = NULL
 3. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) NULL (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> (remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>\<rparr>) \<in> rf_sr)) \<and> (remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> [] \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>\<rparr>) \<in> rf_sr))
 4. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification td. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) NULL (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rbrakk> \<Longrightarrow> set (remove1 thread (ntfnQueue (ntfnObj ntfn'))) \<subseteq> set (ntfnQueue (ntfnObj ntfn'))
 2. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) NULL (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rbrakk> \<Longrightarrow> NULL = NULL
 3. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) NULL (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> (remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>\<rparr>) \<in> rf_sr)) \<and> (remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> [] \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>\<rparr>) \<in> rf_sr))
 4. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) NULL (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rbrakk> \<Longrightarrow> NULL = NULL
 2. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) NULL (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> (remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>\<rparr>) \<in> rf_sr)) \<and> (remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> [] \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>\<rparr>) \<in> rf_sr))
 3. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) NULL (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> (remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>\<rparr>) \<in> rf_sr)) \<and> (remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> [] \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>\<rparr>) \<in> rf_sr))
 2. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setObject ntfn (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn') \<sigma>). (snd xa, x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> (snd ((), \<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfn \<mapsto> injectKOS (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn'))\<rparr>), x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> obj_at' (?P180 \<sigma> x ko' t ta tb ntfn'a tc notification) ntfn \<sigma>
 6. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)) \<and> cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation \<and> cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr \<and> carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>) \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>) \<and> ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<and> ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>) \<and> cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState \<sigma>) (globals x) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x) \<and> cte_array_relation \<sigma> (globals x) \<and> tcb_cte_array_relation \<sigma> (globals x) \<and> apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>) \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>) \<and> ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma> \<and> x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr \<and> {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs \<and> x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr \<and> {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs \<and> htd_safe domain (hrs_htd (t_hrs_' (globals x))) \<and> - domain \<subseteq> kernel_data_refs \<and> globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list \<and> cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule \<and> ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>) \<and> ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>) \<and> ksDomainTime_' (globals x) = ksDomainTime \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift ta) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift ta)) \<and> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn')))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> notification)) ntfn_Ptr (cnotification_relation (cslift ta)) \<and> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> obj_at' (?P180 \<sigma> x ko' t ta tb ntfn'a tc notification) ntfn \<sigma>
 6. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift ta) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift ta)) \<and> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn')))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> notification)) ntfn_Ptr (cnotification_relation (cslift ta)) \<and> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> obj_at' (?P180 \<sigma> x ko' t ta tb ntfn'a tc notification) ntfn \<sigma>
 6. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift ta) tcb_ptr_to_ctcb_ptr ctcb_relation
 2. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift ta))
 3. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn')))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> notification)) ntfn_Ptr (cnotification_relation (cslift ta))
 4. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> obj_at' (?P180 \<sigma> x ko' t ta tb ntfn'a tc notification) ntfn \<sigma>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> map_option tcb_null_queue_ptrs \<circ> cslift ta = map_option tcb_null_queue_ptrs \<circ> cslift x
 2. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift ta))
 3. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn')))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> notification)) ntfn_Ptr (cnotification_relation (cslift ta))
 4. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> obj_at' (?P180 \<sigma> x ko' t ta tb ntfn'a tc notification) ntfn \<sigma>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift ta))
 2. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn')))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> notification)) ntfn_Ptr (cnotification_relation (cslift ta))
 3. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> obj_at' (?P180 \<sigma> x ko' t ta tb ntfn'a tc notification) ntfn \<sigma>
 10. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; map_to_eps (ksPSpace \<sigma>) p = Some a; map_to_eps (ksPSpace \<sigma>) p = Some a'; cslift x (ep_Ptr p) = Some b; cslift x (ep_Ptr p) = Some b'\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift x) a b = cendpoint_relation (cslift ta) a' b'
 2. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn')))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> notification)) ntfn_Ptr (cnotification_relation (cslift ta))
 3. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> obj_at' (?P180 \<sigma> x ko' t ta tb ntfn'a tc notification) ntfn \<sigma>
 10. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift x) a b = cendpoint_relation (cslift ta) a b
 2. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn')))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> notification)) ntfn_Ptr (cnotification_relation (cslift ta))
 3. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> obj_at' (?P180 \<sigma> x ko' t ta tb ntfn'a tc notification) ntfn \<sigma>
 10. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>
 2. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?epptr235 \<sigma> x ko' t ta tb ntfn'a tc notification p a a' b b') \<sigma>
 3. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn')))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> notification)) ntfn_Ptr (cnotification_relation (cslift ta))
 4. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> obj_at' (?P180 \<sigma> x ko' t ta tb ntfn'a tc notification) ntfn \<sigma>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?epptr235 \<sigma> x ko' t ta tb ntfn'a tc notification p a a' b b') \<sigma>
 2. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn')))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> notification)) ntfn_Ptr (cnotification_relation (cslift ta))
 3. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> obj_at' (?P180 \<sigma> x ko' t ta tb ntfn'a tc notification) ntfn \<sigma>
 10. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn')))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> notification)) ntfn_Ptr (cnotification_relation (cslift ta))
 2. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> obj_at' (?P180 \<sigma> x ko' t ta tb ntfn'a tc notification) ntfn \<sigma>
 9. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cnotification_relation (cslift ta) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn') notification
 2. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn') then set (ntfnQueue (ntfnObj ntfn')) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn') then set (ntfnQueue (ntfnObj ntfn')) else {}))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> obj_at' (?P180 \<sigma> x ko' t ta tb ntfn'a tc notification) ntfn \<sigma>
 10. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn') then set (ntfnQueue (ntfnObj ntfn')) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn') then set (ntfnQueue (ntfnObj ntfn')) else {}))\<^esub>
 2. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> obj_at' (?P180 \<sigma> x ko' t ta tb ntfn'a tc notification) ntfn \<sigma>
 9. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 2. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> obj_at' (?P180 \<sigma> x ko' t ta tb ntfn'a tc notification) ntfn \<sigma>
 8. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> map_option tcb_null_ep_ptrs \<circ> cslift ta = map_option tcb_null_ep_ptrs \<circ> cslift x
 2. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> obj_at' (?P180 \<sigma> x ko' t ta tb ntfn'a tc notification) ntfn \<sigma>
 8. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 4. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 5. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 6. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> obj_at' (?P180 \<sigma> x ko' t ta tb ntfn'a tc notification) ntfn \<sigma>
 7. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; isWaitingNtfn (ntfnObj ntfn'); tcb_at' thread \<sigma>; cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); ntfnQueue (ntfnObj ntfn') = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> obj_at' (?P180 \<sigma> x ko' t ta tb ntfn'a tc notification) ntfn \<sigma>
 6. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 2. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 3. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 4. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> obj_at' (?P180 \<sigma> x ko' t ta tb ntfn'a tc notification) ntfn \<sigma>
 5. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 2. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 3. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> obj_at' (?P180 \<sigma> x ko' t ta tb ntfn'a tc notification) ntfn \<sigma>
 4. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 2. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> obj_at' (?P180 \<sigma> x ko' t ta tb ntfn'a tc notification) ntfn \<sigma>
 3. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc notification. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL; notification_lift notification = notification_lift ko'\<lparr>ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0, notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) notification) (hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))); remove1 thread (ntfnQueue (ntfnObj ntfn')) = []\<rbrakk> \<Longrightarrow> obj_at' (?P180 \<sigma> x ko' t ta tb ntfn'a tc notification) ntfn \<sigma>
 2. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<forall>tc\<in>set (remove1 thread (ntfnQueue (ntfnObj ntfn'))). tcb_at' tc (?s253 \<sigma> x ko' t ta tb ntfn'a)
 2. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL) = (remove1 thread (ntfnQueue (ntfnObj ntfn')) = [])\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; tc \<in> set (remove1 thread (ntfnQueue (ntfnObj ntfn')))\<rbrakk> \<Longrightarrow> tc \<in> set (ntfnQueue (ntfnObj ntfn'))
 2. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL) = (remove1 thread (ntfnQueue (ntfnObj ntfn')) = [])\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a tc. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> set (remove1 thread (ntfnQueue (ntfnObj ntfn'))) \<subseteq> set (ntfnQueue (ntfnObj ntfn'))
 2. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL) = (remove1 thread (ntfnQueue (ntfnObj ntfn')) = [])\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = NULL) = (remove1 thread (ntfnQueue (ntfnObj ntfn')) = [])\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfn (ntfnObj_update (\<lambda>_. if remove1 thread (ntfnQueue (ntfnObj ntfn')) = [] then Structures_H.ntfn.IdleNtfn else ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setObject ntfn (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') \<sigma>). (snd xa, x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> (snd ((), \<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfn \<mapsto> injectKOS (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn'))\<rparr>), x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb ntfn'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb ntfn'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb ntfn'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P263 \<sigma> x ko' t ta tb ntfn'a) ntfn \<sigma> proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> (snd ((), \<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfn \<mapsto> injectKOS (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn'))\<rparr>), x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb ntfn'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb ntfn'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb ntfn'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P263 \<sigma> x ko' t ta tb ntfn'a) ntfn \<sigma> proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)) \<and> cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation \<and> cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr \<and> carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>) \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>) \<and> ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<and> ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>) \<and> cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState \<sigma>) (globals x) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x) \<and> cte_array_relation \<sigma> (globals x) \<and> tcb_cte_array_relation \<sigma> (globals x) \<and> apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>) \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>) \<and> ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma> \<and> x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr \<and> {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs \<and> x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr \<and> {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs \<and> htd_safe domain (hrs_htd (t_hrs_' (globals x))) \<and> - domain \<subseteq> kernel_data_refs \<and> globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list \<and> cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule \<and> ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>) \<and> ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>) \<and> ksDomainTime_' (globals x) = ksDomainTime \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift ta) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift ta)) \<and> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn')))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> ntfn'a)) ntfn_Ptr (cnotification_relation (cslift ta)) \<and> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb ntfn'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb ntfn'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb ntfn'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P263 \<sigma> x ko' t ta tb ntfn'a) ntfn \<sigma> proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift ta) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift ta)) \<and> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn')))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> ntfn'a)) ntfn_Ptr (cnotification_relation (cslift ta)) \<and> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb ntfn'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb ntfn'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb ntfn'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P263 \<sigma> x ko' t ta tb ntfn'a) ntfn \<sigma> proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift ta) tcb_ptr_to_ctcb_ptr ctcb_relation
 2. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift ta))
 3. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn')))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> ntfn'a)) ntfn_Ptr (cnotification_relation (cslift ta))
 4. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb ntfn'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb ntfn'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb ntfn'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P263 \<sigma> x ko' t ta tb ntfn'a) ntfn \<sigma> proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> map_option tcb_null_queue_ptrs \<circ> cslift ta = map_option tcb_null_queue_ptrs \<circ> cslift x
 2. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift ta))
 3. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn')))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> ntfn'a)) ntfn_Ptr (cnotification_relation (cslift ta))
 4. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb ntfn'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb ntfn'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb ntfn'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P263 \<sigma> x ko' t ta tb ntfn'a) ntfn \<sigma> proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift ta))
 2. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn')))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> ntfn'a)) ntfn_Ptr (cnotification_relation (cslift ta))
 3. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb ntfn'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb ntfn'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P263 \<sigma> x ko' t ta tb ntfn'a) ntfn \<sigma> proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; map_to_eps (ksPSpace \<sigma>) p = Some a; map_to_eps (ksPSpace \<sigma>) p = Some a'; cslift x (ep_Ptr p) = Some b; cslift x (ep_Ptr p) = Some b'\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift x) a b = cendpoint_relation (cslift ta) a' b'
 2. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn')))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> ntfn'a)) ntfn_Ptr (cnotification_relation (cslift ta))
 3. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb ntfn'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb ntfn'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P263 \<sigma> x ko' t ta tb ntfn'a) ntfn \<sigma> proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift x) a b = cendpoint_relation (cslift ta) a b
 2. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn')))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> ntfn'a)) ntfn_Ptr (cnotification_relation (cslift ta))
 3. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb ntfn'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb ntfn'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P263 \<sigma> x ko' t ta tb ntfn'a) ntfn \<sigma> proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> sym_refs (state_refs_of' (?s321 \<sigma> x ko' t ta tb ntfn'a p a a' b b'))
 2. \<And>\<sigma> x ko' t ta tb ntfn'a p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' (?ntfn321 \<sigma> x ko' t ta tb ntfn'a p a a' b b') (?ntfnptr321 \<sigma> x ko' t ta tb ntfn'a p a a' b b') (?s321 \<sigma> x ko' t ta tb ntfn'a p a a' b b')
 3. \<And>\<sigma> x ko' t ta tb ntfn'a p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> isWaitingNtfn (ntfnObj (?ntfn321 \<sigma> x ko' t ta tb ntfn'a p a a' b b'))
 4. \<And>\<sigma> x ko' t ta tb ntfn'a p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj (?ntfn321 \<sigma> x ko' t ta tb ntfn'a p a a' b b'))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj (?ntfn321 \<sigma> x ko' t ta tb ntfn'a p a a' b b'))))\<^esub>
 5. \<And>\<sigma> x ko' t ta tb ntfn'a p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?epptr321 \<sigma> x ko' t ta tb ntfn'a p a a' b b') (?s321 \<sigma> x ko' t ta tb ntfn'a p a a' b b')
 6. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn')))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> ntfn'a)) ntfn_Ptr (cnotification_relation (cslift ta))
 7. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 8. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 9. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 10. \<And>\<sigma> x ko' t ta tb ntfn'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' (?ntfn321 \<sigma> x ko' t ta tb ntfn'a p a a' b b') (?ntfnptr321 \<sigma> x ko' t ta tb ntfn'a p a a' b b') \<sigma>
 2. \<And>\<sigma> x ko' t ta tb ntfn'a p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> isWaitingNtfn (ntfnObj (?ntfn321 \<sigma> x ko' t ta tb ntfn'a p a a' b b'))
 3. \<And>\<sigma> x ko' t ta tb ntfn'a p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj (?ntfn321 \<sigma> x ko' t ta tb ntfn'a p a a' b b'))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj (?ntfn321 \<sigma> x ko' t ta tb ntfn'a p a a' b b'))))\<^esub>
 4. \<And>\<sigma> x ko' t ta tb ntfn'a p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?epptr321 \<sigma> x ko' t ta tb ntfn'a p a a' b b') \<sigma>
 5. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn')))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> ntfn'a)) ntfn_Ptr (cnotification_relation (cslift ta))
 6. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 7. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 8. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 9. \<And>\<sigma> x ko' t ta tb ntfn'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 10. \<And>\<sigma> x ko' t ta tb ntfn'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
A total of 12 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?epptr321 \<sigma> x ko' t ta tb ntfn'a p a a' b b') \<sigma>
 2. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn')))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> ntfn'a)) ntfn_Ptr (cnotification_relation (cslift ta))
 3. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb ntfn'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb ntfn'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P263 \<sigma> x ko' t ta tb ntfn'a) ntfn \<sigma> proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?epptr321 \<sigma> x ko' t ta tb ntfn'a p a a b b) \<sigma>
 2. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn')))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> ntfn'a)) ntfn_Ptr (cnotification_relation (cslift ta))
 3. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb ntfn'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb ntfn'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P263 \<sigma> x ko' t ta tb ntfn'a) ntfn \<sigma> proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfn \<mapsto> KONotification (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn')))) ((cslift x)(ntfn_Ptr ntfn \<mapsto> ntfn'a)) ntfn_Ptr (cnotification_relation (cslift ta))
 2. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb ntfn'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb ntfn'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P263 \<sigma> x ko' t ta tb ntfn'a) ntfn \<sigma> proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cnotification_relation (cslift ta) (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 thread (ntfnQueue (ntfnObj ntfn'))) (ntfnObj ntfn')) ntfn') ntfn'a
 2. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn') then set (ntfnQueue (ntfnObj ntfn')) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn') then set (ntfnQueue (ntfnObj ntfn')) else {}))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb ntfn'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb ntfn'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P263 \<sigma> x ko' t ta tb ntfn'a) ntfn \<sigma> proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a x3. \<lbrakk>x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t \<sigma>; distinct x3; cslift x (ntfn_Ptr ntfn) = Some ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread x3) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x3)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x3)\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); x3 \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set x3; notification_CL.state_CL (notification_lift ko') = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<and> ep_queue_relation' (cslift x) x3 (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko'))); option_to_ctcb_ptr (ntfnBoundTCB ntfn') = tcb_Ptr (ntfnBoundTCB_CL (notification_lift ko')); ntfnObj ntfn' = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift ta) (remove1 thread x3) (tcb_Ptr (ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4)) (tcb_Ptr (ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4))
 2. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn') then set (ntfnQueue (ntfnObj ntfn')) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn') then set (ntfnQueue (ntfnObj ntfn')) else {}))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb ntfn'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb ntfn'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P263 \<sigma> x ko' t ta tb ntfn'a) ntfn \<sigma> proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a x3. \<lbrakk>x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t \<sigma>; distinct x3; cslift x (ntfn_Ptr ntfn) = Some ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x3)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x3)\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); x3 \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set x3; notification_CL.state_CL (notification_lift ko') = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<and> ep_queue_relation' (cslift x) x3 (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko'))); option_to_ctcb_ptr (ntfnBoundTCB ntfn') = tcb_Ptr (ntfnBoundTCB_CL (notification_lift ko')); ntfnObj ntfn' = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = tcb_Ptr (ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4)
 2. \<And>\<sigma> x ko' t ta tb ntfn'a x3. \<lbrakk>x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t \<sigma>; distinct x3; cslift x (ntfn_Ptr ntfn) = Some ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x3)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x3)\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); x3 \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set x3; notification_CL.state_CL (notification_lift ko') = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<and> ep_queue_relation' (cslift x) x3 (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko'))); option_to_ctcb_ptr (ntfnBoundTCB ntfn') = tcb_Ptr (ntfnBoundTCB_CL (notification_lift ko')); ntfnObj ntfn' = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = tcb_Ptr (ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4)
 3. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn') then set (ntfnQueue (ntfnObj ntfn')) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn') then set (ntfnQueue (ntfnObj ntfn')) else {}))\<^esub>
 4. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb ntfn'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb ntfn'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb ntfn'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P263 \<sigma> x ko' t ta tb ntfn'a) ntfn \<sigma> proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a x3 v va vb. \<lbrakk>x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t \<sigma>; distinct x3; cslift x (ntfn_Ptr ntfn) = Some ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = tcbEPNext_C v; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x3)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x3)\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (tcbEPNext_C v) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); x3 \<noteq> [thread]; tcbEPNext_C v \<noteq> NULL; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set x3; option_to_ctcb_ptr (ntfnBoundTCB ntfn') = tcb_Ptr (ntfnBoundTCB_CL (notification_lift ko')); ntfnObj ntfn' = Structures_H.ntfn.WaitingNtfn x3; cslift x (tcb_ptr_to_ctcb_ptr thread) = Some v; cslift x intStateIRQNode_array_Ptr = Some va; cslift x armKSGlobalPD_Ptr = Some vb; notification_CL.state_CL (notification_lift ko') = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting; ep_queue_relation' (cslift x) x3 (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko'))); tcbEPPrev_C v = NULL\<rbrakk> \<Longrightarrow> tcbEPNext_C v = tcb_Ptr (ptr_val (tcbEPNext_C v) && ~~ mask 4)
 2. \<And>\<sigma> x ko' t ta tb ntfn'a x3. \<lbrakk>x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t \<sigma>; distinct x3; cslift x (ntfn_Ptr ntfn) = Some ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x3)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x3)\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); x3 \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set x3; notification_CL.state_CL (notification_lift ko') = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<and> ep_queue_relation' (cslift x) x3 (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko'))); option_to_ctcb_ptr (ntfnBoundTCB ntfn') = tcb_Ptr (ntfnBoundTCB_CL (notification_lift ko')); ntfnObj ntfn' = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = tcb_Ptr (ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4)
 3. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn') then set (ntfnQueue (ntfnObj ntfn')) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn') then set (ntfnQueue (ntfnObj ntfn')) else {}))\<^esub>
 4. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb ntfn'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb ntfn'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb ntfn'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P263 \<sigma> x ko' t ta tb ntfn'a) ntfn \<sigma> proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a x3. \<lbrakk>x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t \<sigma>; distinct x3; cslift x (ntfn_Ptr ntfn) = Some ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x3)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x3)\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); x3 \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set x3; notification_CL.state_CL (notification_lift ko') = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<and> ep_queue_relation' (cslift x) x3 (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko'))); option_to_ctcb_ptr (ntfnBoundTCB ntfn') = tcb_Ptr (ntfnBoundTCB_CL (notification_lift ko')); ntfnObj ntfn' = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) = tcb_Ptr (ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4)
 2. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn') then set (ntfnQueue (ntfnObj ntfn')) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn') then set (ntfnQueue (ntfnObj ntfn')) else {}))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb ntfn'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb ntfn'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P263 \<sigma> x ko' t ta tb ntfn'a) ntfn \<sigma> proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a x3 v va vb. \<lbrakk>x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t \<sigma>; distinct x3; cslift x (ntfn_Ptr ntfn) = Some ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C v = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = tcbEPPrev_C v; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x3)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x3)\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C v = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcbEPPrev_C v) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); x3 \<noteq> [thread]; (if tcbEPPrev_C v = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set x3; option_to_ctcb_ptr (ntfnBoundTCB ntfn') = tcb_Ptr (ntfnBoundTCB_CL (notification_lift ko')); ntfnObj ntfn' = Structures_H.ntfn.WaitingNtfn x3; cslift x (tcb_ptr_to_ctcb_ptr thread) = Some v; cslift x intStateIRQNode_array_Ptr = Some va; cslift x armKSGlobalPD_Ptr = Some vb; notification_CL.state_CL (notification_lift ko') = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting; ep_queue_relation' (cslift x) x3 (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko'))); tcbEPNext_C v = NULL\<rbrakk> \<Longrightarrow> tcbEPPrev_C v = tcb_Ptr (ptr_val (tcbEPPrev_C v) && ~~ mask 4)
 2. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn') then set (ntfnQueue (ntfnObj ntfn')) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn') then set (ntfnQueue (ntfnObj ntfn')) else {}))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ntfn'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb ntfn'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb ntfn'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P263 \<sigma> x ko' t ta tb ntfn'a) ntfn \<sigma> proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn') then set (ntfnQueue (ntfnObj ntfn')) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn') then set (ntfnQueue (ntfnObj ntfn')) else {}))\<^esub>
 2. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ntfn'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb ntfn'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb ntfn'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P263 \<sigma> x ko' t ta tb ntfn'a) ntfn \<sigma> proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 2. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>\<sigma> x ko' t ta tb ntfn'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>\<sigma> x ko' t ta tb ntfn'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P263 \<sigma> x ko' t ta tb ntfn'a) ntfn \<sigma> proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> map_option tcb_null_ep_ptrs \<circ> cslift ta = map_option tcb_null_ep_ptrs \<circ> cslift x
 2. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ntfn'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>\<sigma> x ko' t ta tb ntfn'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>\<sigma> x ko' t ta tb ntfn'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P263 \<sigma> x ko' t ta tb ntfn'a) ntfn \<sigma> proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb ntfn'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 4. \<And>\<sigma> x ko' t ta tb ntfn'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 5. \<And>\<sigma> x ko' t ta tb ntfn'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 6. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P263 \<sigma> x ko' t ta tb ntfn'a) ntfn \<sigma> proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); ntfnQueue (ntfnObj ntfn') \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb ntfn'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb ntfn'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb ntfn'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P263 \<sigma> x ko' t ta tb ntfn'a) ntfn \<sigma> proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 2. \<And>\<sigma> x ko' t ta tb ntfn'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 3. \<And>\<sigma> x ko' t ta tb ntfn'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 4. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P263 \<sigma> x ko' t ta tb ntfn'a) ntfn \<sigma> proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 2. \<And>\<sigma> x ko' t ta tb ntfn'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 3. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P263 \<sigma> x ko' t ta tb ntfn'a) ntfn \<sigma> proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 2. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P263 \<sigma> x ko' t ta tb ntfn'a) ntfn \<sigma> proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb ntfn'a. \<lbrakk>invs' \<sigma>; st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfn)) thread \<sigma>; ko_at' ntfn' ntfn \<sigma>; (\<sigma>, x) \<in> rf_sr; valid_ntfn' ntfn' \<sigma>; thread \<in> set (ntfnQueue (ntfnObj ntfn')); isWaitingNtfn (ntfnObj ntfn'); ntfnQueue (ntfnObj ntfn') \<noteq> []; \<forall>t\<in>set (ntfnQueue (ntfnObj ntfn')). tcb_at' t \<sigma>; distinct (ntfnQueue (ntfnObj ntfn')); cslift x (ntfn_Ptr ntfn) = Some ko'; cnotification_relation (cslift x) ntfn' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); ep_queue_relation' (cslift ta) (remove1 thread (ntfnQueue (ntfnObj ntfn'))) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj ntfn')))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); notification_lift ntfn'a = notification_lift ko'\<lparr>ntfnQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfn) ntfn'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (ntfnQueue (ntfnObj ntfn')) \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfn)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P263 \<sigma> x ko' t ta tb ntfn'a) ntfn \<sigma> proof (prove)
goal:
No subgoals!