theory Ipc_DR

lemma send_signal_corres:
  notes if_split [split del]
  shows
  "ep_id = epptr \<Longrightarrow> dcorres dc \<top> (invs and valid_etcbs)
     (Endpoint_D.send_signal ep_id)
     (Ipc_A.send_signal epptr badge)" apply (unfold Endpoint_D.send_signal_def Ipc_A.send_signal_def invs_def) apply (rule dcorres_expand_pfx) apply (clarsimp simp:get_simple_ko_def get_object_def gets_def bind_assoc split: if_split) apply (rule dcorres_absorb_get_r) apply (clarsimp simp:assert_def corres_free_fail partial_inv_def a_type_def the_equality
                 split:Structures_A.kernel_object.splits if_split) apply (rule conjI, clarsimp+) apply (rename_tac ntfn_ext) apply (case_tac "ntfn_obj ntfn_ext", clarsimp) apply (case_tac "ntfn_bound_tcb ntfn_ext", clarsimp)
     \<comment> \<open>Idle, not bound\<close> apply (rule corres_alternate1) apply (rule dcorres_absorb_get_l) apply (clarsimp) apply (frule valid_objs_valid_ntfn_simp[rotated]) apply (simp add:valid_state_def valid_pspace_def) apply (simp add:gets_def bind_assoc option_select_def) apply (frule get_notification_pick,simp) apply (clarsimp simp:ntfn_waiting_set_lift valid_state_def valid_ntfn_abstract_def none_is_waiting_ntfn_def) apply (rule corres_guard_imp,rule corres_dummy_set_notification,simp+)[1]
    \<comment> \<open>Idle, bound\<close> apply (clarsimp simp: get_thread_state_def thread_get_def gets_the_def gets_def bind_assoc) apply (rule dcorres_absorb_get_r) apply (clarsimp simp: assert_opt_def corres_free_fail split: Structures_A.kernel_object.splits option.splits) apply (case_tac "receive_blocked (tcb_state x2)")
     \<comment> \<open>receive_blocked\<close> apply (clarsimp) apply (rule corres_alternate2) apply (clarsimp simp: send_signal_bound_def gets_def) apply (rule dcorres_absorb_get_l) apply (clarsimp simp: receive_blocked_waiting_syncs) apply (clarsimp simp: IpcCancel_A.cancel_ipc_def get_thread_state_def thread_get_def gets_the_def gets_def bind_assoc) apply (rule dcorres_absorb_get_r) apply (clarsimp simp: assert_opt_def corres_free_fail split: Structures_A.kernel_object.splits option.splits) apply (simp add: receive_blocked_def) apply (case_tac "tcb_state x2";clarsimp) apply (rule corres_guard_imp) apply (simp add: blocked_cancel_ipc_def bind_assoc) apply (rule corres_symb_exec_r) apply (rule corres_symb_exec_r) apply (rule corres_symb_exec_r) apply (rule corres_dummy_return_pl) apply (rule corres_split[OF corres_dummy_set_sync_ep]) apply (simp add: when_def dc_def[symmetric]) apply (rule corres_split[OF set_thread_state_corres dcorres_dat]) apply (wp cancel_ipc_valid_idle
                        | simp add: not_idle_thread_def invs_def valid_state_def get_blocking_object_def)+ apply (clarsimp dest!:get_tcb_rev simp:invs_def ep_at_def2[symmetric, simplified]) apply (frule valid_tcb_if_valid_state[rotated], clarsimp simp: valid_state_def) apply (fastforce dest!: get_tcb_SomeD
                       simp: receive_blocked_def valid_idle_def pred_tcb_at_def obj_at_def
                             valid_tcb_def valid_tcb_state_def infer_tcb_pending_op_def
                      split: Structures_A.thread_state.splits) apply clarsimp apply (rule corres_alternate1) apply (rule dcorres_absorb_get_l) apply (clarsimp) apply (frule valid_objs_valid_ntfn_simp[rotated]) apply (simp add:valid_state_def valid_pspace_def) apply (simp add:gets_def bind_assoc option_select_def) apply (frule get_notification_pick,simp) apply (clarsimp simp:ntfn_waiting_set_lift valid_state_def valid_ntfn_abstract_def none_is_waiting_ntfn_def) apply (rule corres_guard_imp,rule corres_dummy_set_notification,simp+)[1]
   \<comment> \<open>Waiting\<close> apply (rule corres_alternate1) apply (rule dcorres_absorb_get_l) apply (clarsimp) apply (frule valid_objs_valid_ntfn_simp[rotated]) apply (simp add:valid_state_def valid_pspace_def) apply (simp add:gets_def bind_assoc option_select_def) apply (frule get_notification_pick,simp) apply (clarsimp simp:ntfn_waiting_set_lift valid_state_def valid_ntfn_abstract_def split: if_split) apply (rule conjI) apply (clarsimp simp: dest!:not_empty_list_not_empty_set) apply (clarsimp simp:neq_Nil_conv) apply (rule corres_guard_imp) apply (rule select_pick_corres) apply (rule corres_update_waiting_ntfn_do_notification_transfer) apply (drule_tac s = "insert y (set ys)" in sym) apply (clarsimp simp: image_def) apply (drule_tac s = "insert y (set ys)" in sym) apply (drule_tac A="ntfn_waiting_set epptr s'" and x = y in eqset_imp_iff) apply (clarsimp simp:valid_pspace_def ntfn_waiting_set_def) apply (clarsimp simp: pred_tcb_at_def obj_at_def valid_ntfn_def split:list.splits option.splits)
  \<comment> \<open>Active\<close> apply (rule corres_alternate1) apply (rule dcorres_absorb_get_l) apply (clarsimp) apply (frule valid_objs_valid_ntfn_simp[rotated]) apply (simp add:valid_state_def valid_pspace_def) apply (clarsimp simp:gets_def bind_assoc option_select_def) apply (frule get_notification_pick,simp) apply (clarsimp simp:ntfn_waiting_set_lift valid_state_def valid_ntfn_abstract_def none_is_waiting_ntfn_def) apply (rule corres_guard_imp,rule corres_dummy_set_notification,simp+) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ep_id = epptr \<Longrightarrow> dcorres dc (\<lambda>_. True) (invs and valid_etcbs) (Endpoint_D.send_signal ep_id) (Ipc_A.send_signal epptr badge) proof (prove)
goal (1 subgoal):
 1. ep_id = epptr \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_state and cur_tcb and valid_etcbs) (do waiters <- gets $ get_waiting_ntfn_recv_threads ep_id;
t <- option_select waiters;
case t of None \<Rightarrow> return () | Some receiver \<Rightarrow> do_notification_transfer receiver
od \<sqinter> send_signal_bound ep_id) (do ntfn <- get_notification epptr;
case (ntfn_obj ntfn, ntfn_bound_tcb ntfn) of (IdleNtfn, None) \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn (ActiveNtfn badge) | (IdleNtfn, Some tcb) \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn (ActiveNtfn badge)
od | (WaitingNtfn queue, bound_tcb) \<Rightarrow> update_waiting_ntfn epptr queue bound_tcb badge | (ActiveNtfn badge', bound_tcb) \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn $ ActiveNtfn (combine_ntfn_badges badge badge')
od) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>ep_id = epptr; s = transform s'; True; (valid_state and cur_tcb and valid_etcbs) s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) s) ((=) s') (do waiters <- gets $ get_waiting_ntfn_recv_threads ep_id;
t <- option_select waiters;
case t of None \<Rightarrow> return () | Some receiver \<Rightarrow> do_notification_transfer receiver
od \<sqinter> send_signal_bound ep_id) (do ntfn <- get_notification epptr;
case (ntfn_obj ntfn, ntfn_bound_tcb ntfn) of (IdleNtfn, None) \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn (ActiveNtfn badge) | (IdleNtfn, Some tcb) \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn (ActiveNtfn badge)
od | (WaitingNtfn queue, bound_tcb) \<Rightarrow> update_waiting_ntfn epptr queue bound_tcb badge | (ActiveNtfn badge', bound_tcb) \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn $ ActiveNtfn (combine_ntfn_badges badge badge')
od) proof (prove)
goal (1 subgoal):
 1. \<And>s'. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (do x <- get;
xa <- assert (\<exists>y. kheap x epptr = Some y);
xa <- assert (a_type (the (kheap x epptr)) = AEndpoint \<or> a_type (the (kheap x epptr)) = ANTFN);
ntfn <- case partial_inv kernel_object.Notification (the (kheap x epptr)) of None \<Rightarrow> fail | Some x \<Rightarrow> return x;
case ntfn_obj ntfn of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn $ ActiveNtfn (combine_ntfn_badges badge badge')
od) proof (prove)
goal (1 subgoal):
 1. \<And>s' s'a. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; transform s' = transform s'a; s' = s'a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (do x <- assert (\<exists>y. kheap s'a epptr = Some y);
x <- assert (a_type (the (kheap s'a epptr)) = AEndpoint \<or> a_type (the (kheap s'a epptr)) = ANTFN);
ntfn <- case partial_inv kernel_object.Notification (the (kheap s'a epptr)) of None \<Rightarrow> fail | Some x \<Rightarrow> return x;
case ntfn_obj ntfn of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn $ ActiveNtfn (combine_ntfn_badges badge badge')
od) proof (prove)
goal (1 subgoal):
 1. \<And>s'a. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a\<rbrakk> \<Longrightarrow> ((\<exists>!y. False) \<longrightarrow> (\<exists>y. kheap s'a epptr = Some y) \<longrightarrow> ((\<exists>x3. the (kheap s'a epptr) = kernel_object.Endpoint x3) \<longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj (THE y. kernel_object.Notification y = the (kheap s'a epptr)) of IdleNtfn \<Rightarrow> case ntfn_bound_tcb (THE y. kernel_object.Notification y = the (kheap s'a epptr)) of None \<Rightarrow> set_notification epptr $ ntfn_set_obj (THE y. kernel_object.Notification y = the (kheap s'a epptr)) (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj (THE y. kernel_object.Notification y = the (kheap s'a epptr)) (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb (THE y. kernel_object.Notification y = the (kheap s'a epptr))) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj (THE y. kernel_object.Notification y = the (kheap s'a epptr)) $ ActiveNtfn (combine_ntfn_badges badge badge'))) \<and> (\<forall>x4. the (kheap s'a epptr) = kernel_object.Notification x4 \<longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj x4 of IdleNtfn \<Rightarrow> case ntfn_bound_tcb x4 of None \<Rightarrow> set_notification epptr $ ntfn_set_obj x4 (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj x4 (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb x4) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj x4 $ ActiveNtfn (combine_ntfn_badges badge badge')))) \<and> ((\<nexists>!y. False) \<longrightarrow> (\<exists>y. kheap s'a epptr = Some y) \<longrightarrow> (\<forall>x4. the (kheap s'a epptr) = kernel_object.Notification x4 \<longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj x4 of IdleNtfn \<Rightarrow> case ntfn_bound_tcb x4 of None \<Rightarrow> set_notification epptr $ ntfn_set_obj x4 (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj x4 (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb x4) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj x4 $ ActiveNtfn (combine_ntfn_badges badge badge')))) proof (prove)
goal (1 subgoal):
 1. \<And>s'a x4. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification x4)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj x4 of IdleNtfn \<Rightarrow> case ntfn_bound_tcb x4 of None \<Rightarrow> set_notification epptr $ ntfn_set_obj x4 (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj x4 (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb x4) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj x4 $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (1 subgoal):
 1. \<And>s'a ntfn_ext. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (3 subgoals):
 1. \<And>s'a ntfn_ext. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od)
 2. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 3. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (4 subgoals):
 1. \<And>s'a ntfn_ext. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = None\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (set_notification epptr (ntfn_set_obj ntfn_ext (ActiveNtfn badge)))
 2. \<And>s'a ntfn_ext a. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od)
 3. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 4. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (4 subgoals):
 1. \<And>s'a ntfn_ext. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = None\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od) (set_notification epptr (ntfn_set_obj ntfn_ext (ActiveNtfn badge)))
 2. \<And>s'a ntfn_ext a. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od)
 3. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 4. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (4 subgoals):
 1. \<And>s'a ntfn_ext s'. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = None; transform s'a = transform s'; s'a = s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_ntfn_recv_threads epptr (transform s')) >>= case_option (return ()) do_notification_transfer) (set_notification epptr (ntfn_set_obj ntfn_ext (ActiveNtfn badge)))
 2. \<And>s'a ntfn_ext a. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od)
 3. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 4. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (4 subgoals):
 1. \<And>ntfn_ext s'. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = None\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_ntfn_recv_threads epptr (transform s')) >>= case_option (return ()) do_notification_transfer) (set_notification epptr (ntfn_set_obj ntfn_ext (ActiveNtfn badge)))
 2. \<And>s'a ntfn_ext a. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od)
 3. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 4. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (5 subgoals):
 1. \<And>ntfn_ext s'. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = None\<rbrakk> \<Longrightarrow> valid_objs s'
 2. \<And>ntfn_ext s'. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = None; valid_ntfn ntfn_ext s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_ntfn_recv_threads epptr (transform s')) >>= case_option (return ()) do_notification_transfer) (set_notification epptr (ntfn_set_obj ntfn_ext (ActiveNtfn badge)))
 3. \<And>s'a ntfn_ext a. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od)
 4. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 5. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (4 subgoals):
 1. \<And>ntfn_ext s'. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = None; valid_ntfn ntfn_ext s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_ntfn_recv_threads epptr (transform s')) >>= case_option (return ()) do_notification_transfer) (set_notification epptr (ntfn_set_obj ntfn_ext (ActiveNtfn badge)))
 2. \<And>s'a ntfn_ext a. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od)
 3. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 4. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (4 subgoals):
 1. \<And>ntfn_ext s'. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = None; valid_ntfn ntfn_ext s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if get_waiting_ntfn_recv_threads epptr (transform s') = {} then return None else do a <- select (get_waiting_ntfn_recv_threads epptr (transform s'));
return (Some a)
od) >>= case_option (return ()) do_notification_transfer) (set_notification epptr (ntfn_set_obj ntfn_ext (ActiveNtfn badge)))
 2. \<And>s'a ntfn_ext a. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od)
 3. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 4. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (4 subgoals):
 1. \<And>ntfn_ext s'. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = None; valid_ntfn ntfn_ext s'; valid_ntfn_abstract ntfn_ext epptr s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if get_waiting_ntfn_recv_threads epptr (transform s') = {} then return None else do a <- select (get_waiting_ntfn_recv_threads epptr (transform s'));
return (Some a)
od) >>= case_option (return ()) do_notification_transfer) (set_notification epptr (ntfn_set_obj ntfn_ext (ActiveNtfn badge)))
 2. \<And>s'a ntfn_ext a. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od)
 3. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 4. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (4 subgoals):
 1. \<And>ntfn_ext s'. \<lbrakk>ep_id = epptr; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = None; valid_ntfn ntfn_ext s'; valid_pspace s'; {} = ntfn_bound_set epptr s'; ntfn_waiting_set epptr s' = {}; valid_mdb s'; valid_ioc s'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (return ()) (set_notification epptr (ntfn_set_obj ntfn_ext (ActiveNtfn badge)))
 2. \<And>s'a ntfn_ext a. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od)
 3. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 4. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (3 subgoals):
 1. \<And>s'a ntfn_ext a. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od)
 2. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 3. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (3 subgoals):
 1. \<And>s'a ntfn_ext a. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (do x <- get;
tcb <- assert_opt (get_tcb a x);
if receive_blocked (tcb_state tcb) then do IpcCancel_A.cancel_ipc a;
set_thread_state a Running;
as_user a $ setRegister badge_register badge;
do_extended_op (possible_switch_to a)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od)
 2. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 3. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (3 subgoals):
 1. \<And>s'a ntfn_ext a s'. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; transform s'a = transform s'; s'a = s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (do tcb <- assert_opt (get_tcb a s');
if receive_blocked (tcb_state tcb) then do IpcCancel_A.cancel_ipc a;
set_thread_state a Running;
as_user a $ setRegister badge_register badge;
do_extended_op (possible_switch_to a)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od)
 2. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 3. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (3 subgoals):
 1. \<And>ntfn_ext a s' x2. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (if receive_blocked (tcb_state x2) then do IpcCancel_A.cancel_ipc a;
set_thread_state a Running;
as_user a $ setRegister badge_register badge;
do_extended_op (possible_switch_to a)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge))
 2. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 3. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (4 subgoals):
 1. \<And>ntfn_ext a s' x2. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (if receive_blocked (tcb_state x2) then do IpcCancel_A.cancel_ipc a;
set_thread_state a Running;
as_user a $ setRegister badge_register badge;
do_extended_op (possible_switch_to a)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge))
 2. \<And>ntfn_ext a s' x2. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; \<not> receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (if receive_blocked (tcb_state x2) then do IpcCancel_A.cancel_ipc a;
set_thread_state a Running;
as_user a $ setRegister badge_register badge;
do_extended_op (possible_switch_to a)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge))
 3. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 4. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (4 subgoals):
 1. \<And>ntfn_ext a s' x2. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (do y <- IpcCancel_A.cancel_ipc a;
y <- set_thread_state a Running;
y <- as_user a (setRegister badge_register badge);
possible_switch_to a
od)
 2. \<And>ntfn_ext a s' x2. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; \<not> receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (if receive_blocked (tcb_state x2) then do IpcCancel_A.cancel_ipc a;
set_thread_state a Running;
as_user a $ setRegister badge_register badge;
do_extended_op (possible_switch_to a)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge))
 3. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 4. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (4 subgoals):
 1. \<And>ntfn_ext a s' x2. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (send_signal_bound epptr) (do y <- IpcCancel_A.cancel_ipc a;
y <- set_thread_state a Running;
y <- as_user a (setRegister badge_register badge);
possible_switch_to a
od)
 2. \<And>ntfn_ext a s' x2. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; \<not> receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (if receive_blocked (tcb_state x2) then do IpcCancel_A.cancel_ipc a;
set_thread_state a Running;
as_user a $ setRegister badge_register badge;
do_extended_op (possible_switch_to a)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge))
 3. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 4. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (4 subgoals):
 1. \<And>ntfn_ext a s' x2. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do s <- get;
if get_waiting_sync_bound_ntfn_threads epptr s \<noteq> {} then do t <- select (get_waiting_sync_bound_ntfn_threads epptr s);
KHeap_D.set_cap (t, tcb_pending_op_slot) cdl_cap.NullCap;
do_notification_transfer t
od else return ()
od) (do y <- IpcCancel_A.cancel_ipc a;
y <- set_thread_state a Running;
y <- as_user a (setRegister badge_register badge);
possible_switch_to a
od)
 2. \<And>ntfn_ext a s' x2. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; \<not> receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (if receive_blocked (tcb_state x2) then do IpcCancel_A.cancel_ipc a;
set_thread_state a Running;
as_user a $ setRegister badge_register badge;
do_extended_op (possible_switch_to a)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge))
 3. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 4. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (4 subgoals):
 1. \<And>ntfn_ext a s' x2 s'a. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; receive_blocked (tcb_state x2); transform s' = transform s'a; s' = s'a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (if get_waiting_sync_bound_ntfn_threads epptr (transform s'a) \<noteq> {} then do t <- select (get_waiting_sync_bound_ntfn_threads epptr (transform s'a));
KHeap_D.set_cap (t, tcb_pending_op_slot) cdl_cap.NullCap;
do_notification_transfer t
od else return ()) (do y <- IpcCancel_A.cancel_ipc a;
y <- set_thread_state a Running;
y <- as_user a (setRegister badge_register badge);
possible_switch_to a
od)
 2. \<And>ntfn_ext a s' x2. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; \<not> receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (if receive_blocked (tcb_state x2) then do IpcCancel_A.cancel_ipc a;
set_thread_state a Running;
as_user a $ setRegister badge_register badge;
do_extended_op (possible_switch_to a)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge))
 3. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 4. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (4 subgoals):
 1. \<And>ntfn_ext a x2 s'a. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s'a = Some x2; receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- KHeap_D.set_cap (a, tcb_pending_op_slot) cdl_cap.NullCap;
do_notification_transfer a
od) (do y <- IpcCancel_A.cancel_ipc a;
y <- set_thread_state a Running;
y <- as_user a (setRegister badge_register badge);
possible_switch_to a
od)
 2. \<And>ntfn_ext a s' x2. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; \<not> receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (if receive_blocked (tcb_state x2) then do IpcCancel_A.cancel_ipc a;
set_thread_state a Running;
as_user a $ setRegister badge_register badge;
do_extended_op (possible_switch_to a)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge))
 3. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 4. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (4 subgoals):
 1. \<And>ntfn_ext a x2 s'a. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s'a = Some x2; receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- KHeap_D.set_cap (a, tcb_pending_op_slot) cdl_cap.NullCap;
do_notification_transfer a
od) (do x <- get;
x <- assert_opt (get_tcb a x);
y <- case tcb_state x of BlockedOnReceive xa y \<Rightarrow> blocked_cancel_ipc (tcb_state x) a | BlockedOnSend xa y \<Rightarrow> blocked_cancel_ipc (tcb_state x) a | BlockedOnReply \<Rightarrow> reply_cancel_ipc a | BlockedOnNotification x \<Rightarrow> cancel_signal a x | _ \<Rightarrow> return ();
y <- set_thread_state a Running;
y <- as_user a (setRegister badge_register badge);
possible_switch_to a
od)
 2. \<And>ntfn_ext a s' x2. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; \<not> receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (if receive_blocked (tcb_state x2) then do IpcCancel_A.cancel_ipc a;
set_thread_state a Running;
as_user a $ setRegister badge_register badge;
do_extended_op (possible_switch_to a)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge))
 3. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 4. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (4 subgoals):
 1. \<And>ntfn_ext a x2 s'a s'. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s'a = Some x2; receive_blocked (tcb_state x2); transform s'a = transform s'; s'a = s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- KHeap_D.set_cap (a, tcb_pending_op_slot) cdl_cap.NullCap;
do_notification_transfer a
od) (do x <- assert_opt (get_tcb a s');
y <- case tcb_state x of BlockedOnReceive xa y \<Rightarrow> blocked_cancel_ipc (tcb_state x) a | BlockedOnSend xa y \<Rightarrow> blocked_cancel_ipc (tcb_state x) a | BlockedOnReply \<Rightarrow> reply_cancel_ipc a | BlockedOnNotification x \<Rightarrow> cancel_signal a x | _ \<Rightarrow> return ();
y <- set_thread_state a Running;
y <- as_user a (setRegister badge_register badge);
possible_switch_to a
od)
 2. \<And>ntfn_ext a s' x2. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; \<not> receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (if receive_blocked (tcb_state x2) then do IpcCancel_A.cancel_ipc a;
set_thread_state a Running;
as_user a $ setRegister badge_register badge;
do_extended_op (possible_switch_to a)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge))
 3. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 4. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (4 subgoals):
 1. \<And>ntfn_ext a x2 s'. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- KHeap_D.set_cap (a, tcb_pending_op_slot) cdl_cap.NullCap;
do_notification_transfer a
od) (do y <- case tcb_state x2 of BlockedOnReceive x y \<Rightarrow> blocked_cancel_ipc (tcb_state x2) a | BlockedOnSend x y \<Rightarrow> blocked_cancel_ipc (tcb_state x2) a | BlockedOnReply \<Rightarrow> reply_cancel_ipc a | BlockedOnNotification x \<Rightarrow> cancel_signal a x | _ \<Rightarrow> return ();
y <- set_thread_state a Running;
y <- as_user a (setRegister badge_register badge);
possible_switch_to a
od)
 2. \<And>ntfn_ext a s' x2. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; \<not> receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (if receive_blocked (tcb_state x2) then do IpcCancel_A.cancel_ipc a;
set_thread_state a Running;
as_user a $ setRegister badge_register badge;
do_extended_op (possible_switch_to a)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge))
 3. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 4. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (4 subgoals):
 1. \<And>ntfn_ext a x2 s'. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; case tcb_state x2 of BlockedOnReceive x xa \<Rightarrow> True | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- KHeap_D.set_cap (a, tcb_pending_op_slot) cdl_cap.NullCap;
do_notification_transfer a
od) (do y <- case tcb_state x2 of BlockedOnReceive x y \<Rightarrow> blocked_cancel_ipc (tcb_state x2) a | BlockedOnSend x y \<Rightarrow> blocked_cancel_ipc (tcb_state x2) a | BlockedOnReply \<Rightarrow> reply_cancel_ipc a | BlockedOnNotification x \<Rightarrow> cancel_signal a x | _ \<Rightarrow> return ();
y <- set_thread_state a Running;
y <- as_user a (setRegister badge_register badge);
possible_switch_to a
od)
 2. \<And>ntfn_ext a s' x2. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; \<not> receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (if receive_blocked (tcb_state x2) then do IpcCancel_A.cancel_ipc a;
set_thread_state a Running;
as_user a $ setRegister badge_register badge;
do_extended_op (possible_switch_to a)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge))
 3. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 4. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (4 subgoals):
 1. \<And>ntfn_ext a x2 s' x41 x42. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- KHeap_D.set_cap (a, tcb_pending_op_slot) cdl_cap.NullCap;
do_notification_transfer a
od) (do y <- blocked_cancel_ipc (BlockedOnReceive x41 x42) a;
y <- set_thread_state a Running;
y <- as_user a (setRegister badge_register badge);
possible_switch_to a
od)
 2. \<And>ntfn_ext a s' x2. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; \<not> receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (if receive_blocked (tcb_state x2) then do IpcCancel_A.cancel_ipc a;
set_thread_state a Running;
as_user a $ setRegister badge_register badge;
do_extended_op (possible_switch_to a)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge))
 3. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 4. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (6 subgoals):
 1. \<And>ntfn_ext a x2 s' x41 x42. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> dcorres dc (?Q168 ntfn_ext a x2 s' x41 x42) (?Q'168 ntfn_ext a x2 s' x41 x42) (do y <- KHeap_D.set_cap (a, tcb_pending_op_slot) cdl_cap.NullCap;
do_notification_transfer a
od) (do y <- blocked_cancel_ipc (BlockedOnReceive x41 x42) a;
y <- set_thread_state a Running;
y <- as_user a (setRegister badge_register badge);
possible_switch_to a
od)
 2. \<And>ntfn_ext a x2 s' x41 x42 s. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; transform s' = s\<rbrakk> \<Longrightarrow> ?Q168 ntfn_ext a x2 s' x41 x42 s
 3. \<And>ntfn_ext a x2 s' x41 x42 s. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; s' = s\<rbrakk> \<Longrightarrow> ?Q'168 ntfn_ext a x2 s' x41 x42 s
 4. \<And>ntfn_ext a s' x2. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; \<not> receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (if receive_blocked (tcb_state x2) then do IpcCancel_A.cancel_ipc a;
set_thread_state a Running;
as_user a $ setRegister badge_register badge;
do_extended_op (possible_switch_to a)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge))
 5. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 6. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (6 subgoals):
 1. \<And>ntfn_ext a x2 s' x41 x42. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> dcorres dc (?Q168 ntfn_ext a x2 s' x41 x42) (?Q'168 ntfn_ext a x2 s' x41 x42) (do y <- KHeap_D.set_cap (a, tcb_pending_op_slot) cdl_cap.NullCap;
do_notification_transfer a
od) (do x <- get_blocking_object (BlockedOnReceive x41 x42);
xa <- get_endpoint x;
xb <- get_ep_queue xa;
x <- set_endpoint x (case remove1 a xb of [] \<Rightarrow> IdleEP | aa # list \<Rightarrow> update_ep_queue xa (remove1 a xb));
y <- set_thread_state a Inactive;
y <- set_thread_state a Running;
y <- as_user a (setRegister badge_register badge);
possible_switch_to a
od)
 2. \<And>ntfn_ext a x2 s' x41 x42 s. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; transform s' = s\<rbrakk> \<Longrightarrow> ?Q168 ntfn_ext a x2 s' x41 x42 s
 3. \<And>ntfn_ext a x2 s' x41 x42 s. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; s' = s\<rbrakk> \<Longrightarrow> ?Q'168 ntfn_ext a x2 s' x41 x42 s
 4. \<And>ntfn_ext a s' x2. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; \<not> receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (if receive_blocked (tcb_state x2) then do IpcCancel_A.cancel_ipc a;
set_thread_state a Running;
as_user a $ setRegister badge_register badge;
do_extended_op (possible_switch_to a)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge))
 5. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 6. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (9 subgoals):
 1. \<And>ntfn_ext a x2 s' x41 x42 x. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> dcorres dc (?Q168 ntfn_ext a x2 s' x41 x42) (?Q'172 ntfn_ext a x2 s' x41 x42 x) (do y <- KHeap_D.set_cap (a, tcb_pending_op_slot) cdl_cap.NullCap;
do_notification_transfer a
od) (do xa <- get_endpoint x;
xb <- get_ep_queue xa;
x <- set_endpoint x (case remove1 a xb of [] \<Rightarrow> IdleEP | aa # list \<Rightarrow> update_ep_queue xa (remove1 a xb));
y <- set_thread_state a Inactive;
y <- set_thread_state a Running;
y <- as_user a (setRegister badge_register badge);
possible_switch_to a
od)
 2. \<And>ntfn_ext a x2 s' x41 x42. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'168 ntfn_ext a x2 s' x41 x42\<rbrace> get_blocking_object (BlockedOnReceive x41 x42) \<lbrace>?Q'172 ntfn_ext a x2 s' x41 x42\<rbrace>
 3. \<And>ntfn_ext a x2 s' x41 x42 s. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; ?Q'168 ntfn_ext a x2 s' x41 x42 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_blocking_object (BlockedOnReceive x41 x42) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>ntfn_ext a x2 s' x41 x42. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'168 ntfn_ext a x2 s' x41 x42) (get_blocking_object (BlockedOnReceive x41 x42))
 5. \<And>ntfn_ext a x2 s' x41 x42 s. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; transform s' = s\<rbrakk> \<Longrightarrow> ?Q168 ntfn_ext a x2 s' x41 x42 s
 6. \<And>ntfn_ext a x2 s' x41 x42 s. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; s' = s\<rbrakk> \<Longrightarrow> ?Q'168 ntfn_ext a x2 s' x41 x42 s
 7. \<And>ntfn_ext a s' x2. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; \<not> receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (if receive_blocked (tcb_state x2) then do IpcCancel_A.cancel_ipc a;
set_thread_state a Running;
as_user a $ setRegister badge_register badge;
do_extended_op (possible_switch_to a)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge))
 8. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 9. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (12 subgoals):
 1. \<And>ntfn_ext a x2 s' x41 x42 x xa. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> dcorres dc (?Q168 ntfn_ext a x2 s' x41 x42) (?Q'177 ntfn_ext a x2 s' x41 x42 x xa) (do y <- KHeap_D.set_cap (a, tcb_pending_op_slot) cdl_cap.NullCap;
do_notification_transfer a
od) (do xb <- get_ep_queue xa;
x <- set_endpoint x (case remove1 a xb of [] \<Rightarrow> IdleEP | aa # list \<Rightarrow> update_ep_queue xa (remove1 a xb));
y <- set_thread_state a Inactive;
y <- set_thread_state a Running;
y <- as_user a (setRegister badge_register badge);
possible_switch_to a
od)
 2. \<And>ntfn_ext a x2 s' x41 x42 x. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'172 ntfn_ext a x2 s' x41 x42 x\<rbrace> get_endpoint x \<lbrace>?Q'177 ntfn_ext a x2 s' x41 x42 x\<rbrace>
 3. \<And>ntfn_ext a x2 s' x41 x42 x s. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; ?Q'172 ntfn_ext a x2 s' x41 x42 x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint x \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>ntfn_ext a x2 s' x41 x42 x. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'172 ntfn_ext a x2 s' x41 x42 x) (get_endpoint x)
 5. \<And>ntfn_ext a x2 s' x41 x42. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'168 ntfn_ext a x2 s' x41 x42\<rbrace> get_blocking_object (BlockedOnReceive x41 x42) \<lbrace>?Q'172 ntfn_ext a x2 s' x41 x42\<rbrace>
 6. \<And>ntfn_ext a x2 s' x41 x42 s. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; ?Q'168 ntfn_ext a x2 s' x41 x42 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_blocking_object (BlockedOnReceive x41 x42) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>ntfn_ext a x2 s' x41 x42. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'168 ntfn_ext a x2 s' x41 x42) (get_blocking_object (BlockedOnReceive x41 x42))
 8. \<And>ntfn_ext a x2 s' x41 x42 s. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; transform s' = s\<rbrakk> \<Longrightarrow> ?Q168 ntfn_ext a x2 s' x41 x42 s
 9. \<And>ntfn_ext a x2 s' x41 x42 s. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; s' = s\<rbrakk> \<Longrightarrow> ?Q'168 ntfn_ext a x2 s' x41 x42 s
 10. \<And>ntfn_ext a s' x2. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; \<not> receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (if receive_blocked (tcb_state x2) then do IpcCancel_A.cancel_ipc a;
set_thread_state a Running;
as_user a $ setRegister badge_register badge;
do_extended_op (possible_switch_to a)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge))
A total of 12 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>ntfn_ext a x2 s' x41 x42 x xa xb. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> dcorres dc (?Q168 ntfn_ext a x2 s' x41 x42) (?Q'182 ntfn_ext a x2 s' x41 x42 x xa xb) (do y <- KHeap_D.set_cap (a, tcb_pending_op_slot) cdl_cap.NullCap;
do_notification_transfer a
od) (do x <- set_endpoint x (case remove1 a xb of [] \<Rightarrow> IdleEP | aa # list \<Rightarrow> update_ep_queue xa (remove1 a xb));
y <- set_thread_state a Inactive;
y <- set_thread_state a Running;
y <- as_user a (setRegister badge_register badge);
possible_switch_to a
od)
 2. \<And>ntfn_ext a x2 s' x41 x42 x xa. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'177 ntfn_ext a x2 s' x41 x42 x xa\<rbrace> get_ep_queue xa \<lbrace>?Q'182 ntfn_ext a x2 s' x41 x42 x xa\<rbrace>
 3. \<And>ntfn_ext a x2 s' x41 x42 x xa s. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; ?Q'177 ntfn_ext a x2 s' x41 x42 x xa s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_ep_queue xa \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>ntfn_ext a x2 s' x41 x42 x xa. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'177 ntfn_ext a x2 s' x41 x42 x xa) (get_ep_queue xa)
 5. \<And>ntfn_ext a x2 s' x41 x42 x. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'172 ntfn_ext a x2 s' x41 x42 x\<rbrace> get_endpoint x \<lbrace>?Q'177 ntfn_ext a x2 s' x41 x42 x\<rbrace>
 6. \<And>ntfn_ext a x2 s' x41 x42 x s. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; ?Q'172 ntfn_ext a x2 s' x41 x42 x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint x \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>ntfn_ext a x2 s' x41 x42 x. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'172 ntfn_ext a x2 s' x41 x42 x) (get_endpoint x)
 8. \<And>ntfn_ext a x2 s' x41 x42. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'168 ntfn_ext a x2 s' x41 x42\<rbrace> get_blocking_object (BlockedOnReceive x41 x42) \<lbrace>?Q'172 ntfn_ext a x2 s' x41 x42\<rbrace>
 9. \<And>ntfn_ext a x2 s' x41 x42 s. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; ?Q'168 ntfn_ext a x2 s' x41 x42 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_blocking_object (BlockedOnReceive x41 x42) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>ntfn_ext a x2 s' x41 x42. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'168 ntfn_ext a x2 s' x41 x42) (get_blocking_object (BlockedOnReceive x41 x42))
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>ntfn_ext a x2 s' x41 x42 x xa xb. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> dcorres dc (?Q168 ntfn_ext a x2 s' x41 x42) (?Q'182 ntfn_ext a x2 s' x41 x42 x xa xb) (do return (?b187 ntfn_ext a x2 s' x41 x42 x xa xb);
y <- KHeap_D.set_cap (a, tcb_pending_op_slot) cdl_cap.NullCap;
do_notification_transfer a
od) (do x <- set_endpoint x (case remove1 a xb of [] \<Rightarrow> IdleEP | aa # list \<Rightarrow> update_ep_queue xa (remove1 a xb));
y <- set_thread_state a Inactive;
y <- set_thread_state a Running;
y <- as_user a (setRegister badge_register badge);
possible_switch_to a
od)
 2. \<And>ntfn_ext a x2 s' x41 x42 x xa. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'177 ntfn_ext a x2 s' x41 x42 x xa\<rbrace> get_ep_queue xa \<lbrace>?Q'182 ntfn_ext a x2 s' x41 x42 x xa\<rbrace>
 3. \<And>ntfn_ext a x2 s' x41 x42 x xa s. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; ?Q'177 ntfn_ext a x2 s' x41 x42 x xa s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_ep_queue xa \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>ntfn_ext a x2 s' x41 x42 x xa. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'177 ntfn_ext a x2 s' x41 x42 x xa) (get_ep_queue xa)
 5. \<And>ntfn_ext a x2 s' x41 x42 x. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'172 ntfn_ext a x2 s' x41 x42 x\<rbrace> get_endpoint x \<lbrace>?Q'177 ntfn_ext a x2 s' x41 x42 x\<rbrace>
 6. \<And>ntfn_ext a x2 s' x41 x42 x s. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; ?Q'172 ntfn_ext a x2 s' x41 x42 x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint x \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>ntfn_ext a x2 s' x41 x42 x. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'172 ntfn_ext a x2 s' x41 x42 x) (get_endpoint x)
 8. \<And>ntfn_ext a x2 s' x41 x42. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'168 ntfn_ext a x2 s' x41 x42\<rbrace> get_blocking_object (BlockedOnReceive x41 x42) \<lbrace>?Q'172 ntfn_ext a x2 s' x41 x42\<rbrace>
 9. \<And>ntfn_ext a x2 s' x41 x42 s. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; ?Q'168 ntfn_ext a x2 s' x41 x42 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_blocking_object (BlockedOnReceive x41 x42) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>ntfn_ext a x2 s' x41 x42. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'168 ntfn_ext a x2 s' x41 x42) (get_blocking_object (BlockedOnReceive x41 x42))
A total of 15 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>ntfn_ext a x2 s' x41 x42 x xa xb rv xc. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; dc rv xc\<rbrakk> \<Longrightarrow> dcorres dc (?R189 ntfn_ext a x2 s' x41 x42 x xa xb rv) (?R'189 ntfn_ext a x2 s' x41 x42 x xa xb xc) (K_bind (do y <- KHeap_D.set_cap (a, tcb_pending_op_slot) cdl_cap.NullCap;
do_notification_transfer a
od) rv) (do y <- set_thread_state a Inactive;
y <- set_thread_state a Running;
y <- as_user a (setRegister badge_register badge);
possible_switch_to a
od)
 2. \<And>ntfn_ext a x2 s' x41 x42 x xa xb. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q191 ntfn_ext a x2 s' x41 x42\<rbrace> return (?b187 ntfn_ext a x2 s' x41 x42 x xa xb) \<lbrace>?R189 ntfn_ext a x2 s' x41 x42 x xa xb\<rbrace>
 3. \<And>ntfn_ext a x2 s' x41 x42 x xa xb. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'189 ntfn_ext a x2 s' x41 x42 x xa xb\<rbrace> set_endpoint x (case remove1 a xb of [] \<Rightarrow> IdleEP | aa # list \<Rightarrow> update_ep_queue xa (remove1 a xb)) \<lbrace>?R'189 ntfn_ext a x2 s' x41 x42 x xa xb\<rbrace>
 4. \<And>ntfn_ext a x2 s' x41 x42 x xa. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'177 ntfn_ext a x2 s' x41 x42 x xa\<rbrace> get_ep_queue xa \<lbrace>\<lambda>xb. (\<lambda>_. True) and ?Q'189 ntfn_ext a x2 s' x41 x42 x xa xb\<rbrace>
 5. \<And>ntfn_ext a x2 s' x41 x42 x xa s. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; ?Q'177 ntfn_ext a x2 s' x41 x42 x xa s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_ep_queue xa \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>ntfn_ext a x2 s' x41 x42 x xa. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'177 ntfn_ext a x2 s' x41 x42 x xa) (get_ep_queue xa)
 7. \<And>ntfn_ext a x2 s' x41 x42 x. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'172 ntfn_ext a x2 s' x41 x42 x\<rbrace> get_endpoint x \<lbrace>?Q'177 ntfn_ext a x2 s' x41 x42 x\<rbrace>
 8. \<And>ntfn_ext a x2 s' x41 x42 x s. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; ?Q'172 ntfn_ext a x2 s' x41 x42 x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint x \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>ntfn_ext a x2 s' x41 x42 x. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'172 ntfn_ext a x2 s' x41 x42 x) (get_endpoint x)
 10. \<And>ntfn_ext a x2 s' x41 x42. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'168 ntfn_ext a x2 s' x41 x42\<rbrace> get_blocking_object (BlockedOnReceive x41 x42) \<lbrace>?Q'172 ntfn_ext a x2 s' x41 x42\<rbrace>
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>ntfn_ext a x2 s' x41 x42 x xa xb rv. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> dcorres dc (?R189 ntfn_ext a x2 s' x41 x42 x xa xb rv) (?R'189 ntfn_ext a x2 s' x41 x42 x xa xb ()) (do y <- KHeap_D.set_cap (a, tcb_pending_op_slot) cdl_cap.NullCap;
do_notification_transfer a
od) (do y <- set_thread_state a Inactive;
y <- set_thread_state a Running;
y <- as_user a (setRegister badge_register badge);
possible_switch_to a
od)
 2. \<And>ntfn_ext a x2 s' x41 x42 x xa xb. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q191 ntfn_ext a x2 s' x41 x42\<rbrace> return (?b187 ntfn_ext a x2 s' x41 x42 x xa xb) \<lbrace>?R189 ntfn_ext a x2 s' x41 x42 x xa xb\<rbrace>
 3. \<And>ntfn_ext a x2 s' x41 x42 x xa xb. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'189 ntfn_ext a x2 s' x41 x42 x xa xb\<rbrace> set_endpoint x (case remove1 a xb of [] \<Rightarrow> IdleEP | aa # list \<Rightarrow> update_ep_queue xa (remove1 a xb)) \<lbrace>?R'189 ntfn_ext a x2 s' x41 x42 x xa xb\<rbrace>
 4. \<And>ntfn_ext a x2 s' x41 x42 x xa. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'177 ntfn_ext a x2 s' x41 x42 x xa\<rbrace> get_ep_queue xa \<lbrace>\<lambda>xb. (\<lambda>_. True) and ?Q'189 ntfn_ext a x2 s' x41 x42 x xa xb\<rbrace>
 5. \<And>ntfn_ext a x2 s' x41 x42 x xa s. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; ?Q'177 ntfn_ext a x2 s' x41 x42 x xa s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_ep_queue xa \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>ntfn_ext a x2 s' x41 x42 x xa. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'177 ntfn_ext a x2 s' x41 x42 x xa) (get_ep_queue xa)
 7. \<And>ntfn_ext a x2 s' x41 x42 x. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'172 ntfn_ext a x2 s' x41 x42 x\<rbrace> get_endpoint x \<lbrace>?Q'177 ntfn_ext a x2 s' x41 x42 x\<rbrace>
 8. \<And>ntfn_ext a x2 s' x41 x42 x s. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; ?Q'172 ntfn_ext a x2 s' x41 x42 x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint x \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>ntfn_ext a x2 s' x41 x42 x. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'172 ntfn_ext a x2 s' x41 x42 x) (get_endpoint x)
 10. \<And>ntfn_ext a x2 s' x41 x42. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'168 ntfn_ext a x2 s' x41 x42\<rbrace> get_blocking_object (BlockedOnReceive x41 x42) \<lbrace>?Q'172 ntfn_ext a x2 s' x41 x42\<rbrace>
A total of 17 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>ntfn_ext a x2 s' x41 x42 x xa xb rv. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q195 ntfn_ext a x2 s' x41 x42 x xa xb rv\<rbrace> KHeap_D.set_cap (a, tcb_pending_op_slot) cdl_cap.NullCap \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>ntfn_ext a x2 s' x41 x42 x xa xb rv. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'214 ntfn_ext a x2 s' x41 x42 x xa xb ()\<rbrace> set_thread_state a Inactive \<lbrace>\<lambda>b. valid_etcbs and not_idle_thread a and valid_idle\<rbrace>
 3. \<And>ntfn_ext a x2 s' x41 x42 x xa xb. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q191 ntfn_ext a x2 s' x41 x42\<rbrace> return (?b187 ntfn_ext a x2 s' x41 x42 x xa xb) \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q195 ntfn_ext a x2 s' x41 x42 x xa xb rv\<rbrace>
 4. \<And>ntfn_ext a x2 s' x41 x42 x xa xb. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'189 ntfn_ext a x2 s' x41 x42 x xa xb\<rbrace> set_endpoint x (case remove1 a xb of [] \<Rightarrow> IdleEP | aa # list \<Rightarrow> update_ep_queue xa (remove1 a xb)) \<lbrace>\<lambda>b. not_idle_thread a and K (cdl_cap.NullCap = infer_tcb_pending_op a Inactive) and valid_etcbs and ?Q'214 ntfn_ext a x2 s' x41 x42 x xa xb b\<rbrace>
 5. \<And>ntfn_ext a x2 s' x41 x42 x xa. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'177 ntfn_ext a x2 s' x41 x42 x xa\<rbrace> get_ep_queue xa \<lbrace>\<lambda>xb. (\<lambda>_. True) and ?Q'189 ntfn_ext a x2 s' x41 x42 x xa xb\<rbrace>
 6. \<And>ntfn_ext a x2 s' x41 x42 x xa s. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; ?Q'177 ntfn_ext a x2 s' x41 x42 x xa s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_ep_queue xa \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>ntfn_ext a x2 s' x41 x42 x xa. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'177 ntfn_ext a x2 s' x41 x42 x xa) (get_ep_queue xa)
 8. \<And>ntfn_ext a x2 s' x41 x42 x. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'172 ntfn_ext a x2 s' x41 x42 x\<rbrace> get_endpoint x \<lbrace>?Q'177 ntfn_ext a x2 s' x41 x42 x\<rbrace>
 9. \<And>ntfn_ext a x2 s' x41 x42 x s. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; ?Q'172 ntfn_ext a x2 s' x41 x42 x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint x \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>ntfn_ext a x2 s' x41 x42 x. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'172 ntfn_ext a x2 s' x41 x42 x) (get_endpoint x)
A total of 18 subgoals... proof (prove)
goal (4 subgoals):
 1. \<And>ntfn_ext a x2 s' x41 x42 s. \<lbrakk>ep_id = epptr; valid_pspace s \<and> valid_mdb s \<and> valid_ioc s \<and> valid_idle s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s; cur_tcb s; valid_etcbs s; \<nexists>!y. False; kheap s epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; s' = s\<rbrakk> \<Longrightarrow> a \<noteq> idle_thread s \<and> obj_at (\<lambda>ko. \<exists>y. kernel_object.Endpoint y = ko) x41 s \<and> a \<noteq> idle_thread s
 2. \<And>ntfn_ext a s' x2. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; \<not> receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (if receive_blocked (tcb_state x2) then do IpcCancel_A.cancel_ipc a;
set_thread_state a Running;
as_user a $ setRegister badge_register badge;
do_extended_op (possible_switch_to a)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge))
 3. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 4. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (4 subgoals):
 1. \<And>ntfn_ext a x2 x41 x42 s. \<lbrakk>ep_id = epptr; cur_tcb s; valid_etcbs s; \<nexists>!y. False; kheap s epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; valid_pspace s; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s\<rbrakk> \<Longrightarrow> a \<noteq> idle_thread s \<and> ep_at x41 s \<and> a \<noteq> idle_thread s
 2. \<And>ntfn_ext a s' x2. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; \<not> receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (if receive_blocked (tcb_state x2) then do IpcCancel_A.cancel_ipc a;
set_thread_state a Running;
as_user a $ setRegister badge_register badge;
do_extended_op (possible_switch_to a)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge))
 3. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 4. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (4 subgoals):
 1. \<And>ntfn_ext a x2 x41 x42 s. \<lbrakk>ep_id = epptr; cur_tcb s; valid_etcbs s; \<nexists>!y. False; kheap s epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s = Some x2; tcb_state x2 = BlockedOnReceive x41 x42; valid_pspace s; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; valid_tcb a x2 s\<rbrakk> \<Longrightarrow> a \<noteq> idle_thread s \<and> ep_at x41 s \<and> a \<noteq> idle_thread s
 2. \<And>ntfn_ext a s' x2. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; \<not> receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (if receive_blocked (tcb_state x2) then do IpcCancel_A.cancel_ipc a;
set_thread_state a Running;
as_user a $ setRegister badge_register badge;
do_extended_op (possible_switch_to a)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge))
 3. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 4. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (3 subgoals):
 1. \<And>ntfn_ext a s' x2. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; \<not> receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (if receive_blocked (tcb_state x2) then do IpcCancel_A.cancel_ipc a;
set_thread_state a Running;
as_user a $ setRegister badge_register badge;
do_extended_op (possible_switch_to a)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge))
 2. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 3. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (3 subgoals):
 1. \<And>ntfn_ext a s' x2. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; \<not> receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (set_notification epptr (ntfn_set_obj ntfn_ext (ActiveNtfn badge)))
 2. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 3. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (3 subgoals):
 1. \<And>ntfn_ext a s' x2. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; \<not> receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od) (set_notification epptr (ntfn_set_obj ntfn_ext (ActiveNtfn badge)))
 2. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 3. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (3 subgoals):
 1. \<And>ntfn_ext a s' x2 s'a. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s' = Some x2; \<not> receive_blocked (tcb_state x2); transform s' = transform s'a; s' = s'a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (option_select (get_waiting_ntfn_recv_threads epptr (transform s'a)) >>= case_option (return ()) do_notification_transfer) (set_notification epptr (ntfn_set_obj ntfn_ext (ActiveNtfn badge)))
 2. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 3. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (3 subgoals):
 1. \<And>ntfn_ext a x2 s'a. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s'a = Some x2; \<not> receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (option_select (get_waiting_ntfn_recv_threads epptr (transform s'a)) >>= case_option (return ()) do_notification_transfer) (set_notification epptr (ntfn_set_obj ntfn_ext (ActiveNtfn badge)))
 2. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 3. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (4 subgoals):
 1. \<And>ntfn_ext a x2 s'a. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s'a = Some x2; \<not> receive_blocked (tcb_state x2)\<rbrakk> \<Longrightarrow> valid_objs s'a
 2. \<And>ntfn_ext a x2 s'a. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s'a = Some x2; \<not> receive_blocked (tcb_state x2); valid_ntfn ntfn_ext s'a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (option_select (get_waiting_ntfn_recv_threads epptr (transform s'a)) >>= case_option (return ()) do_notification_transfer) (set_notification epptr (ntfn_set_obj ntfn_ext (ActiveNtfn badge)))
 3. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 4. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (3 subgoals):
 1. \<And>ntfn_ext a x2 s'a. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s'a = Some x2; \<not> receive_blocked (tcb_state x2); valid_ntfn ntfn_ext s'a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (option_select (get_waiting_ntfn_recv_threads epptr (transform s'a)) >>= case_option (return ()) do_notification_transfer) (set_notification epptr (ntfn_set_obj ntfn_ext (ActiveNtfn badge)))
 2. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 3. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (3 subgoals):
 1. \<And>ntfn_ext a x2 s'a. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s'a = Some x2; \<not> receive_blocked (tcb_state x2); valid_ntfn ntfn_ext s'a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) ((if get_waiting_ntfn_recv_threads epptr (transform s'a) = {} then return None else do a <- select (get_waiting_ntfn_recv_threads epptr (transform s'a));
return (Some a)
od) >>= case_option (return ()) do_notification_transfer) (set_notification epptr (ntfn_set_obj ntfn_ext (ActiveNtfn badge)))
 2. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 3. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (3 subgoals):
 1. \<And>ntfn_ext a x2 s'a. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s'a = Some x2; \<not> receive_blocked (tcb_state x2); valid_ntfn ntfn_ext s'a; valid_ntfn_abstract ntfn_ext epptr s'a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) ((if get_waiting_ntfn_recv_threads epptr (transform s'a) = {} then return None else do a <- select (get_waiting_ntfn_recv_threads epptr (transform s'a));
return (Some a)
od) >>= case_option (return ()) do_notification_transfer) (set_notification epptr (ntfn_set_obj ntfn_ext (ActiveNtfn badge)))
 2. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 3. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (3 subgoals):
 1. \<And>ntfn_ext a x2 s'a. \<lbrakk>ep_id = epptr; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = IdleNtfn; ntfn_bound_tcb ntfn_ext = Some a; get_tcb a s'a = Some x2; \<not> receive_blocked (tcb_state x2); valid_ntfn ntfn_ext s'a; valid_pspace s'a; {a} = ntfn_bound_set epptr s'a; ntfn_waiting_set epptr s'a = {}; valid_mdb s'a; valid_ioc s'a; valid_idle s'a; only_idle s'a; if_unsafe_then_cap s'a; valid_reply_caps s'a; valid_reply_masters s'a; valid_global_refs s'a; valid_arch_state s'a; valid_irq_node s'a; valid_irq_handlers s'a; valid_irq_states s'a; valid_machine_state s'a; valid_vspace_objs s'a; valid_arch_caps s'a; valid_global_objs s'a; valid_kernel_mappings s'a; equal_kernel_mappings s'a; valid_asid_map s'a; valid_global_vspace_mappings s'a; pspace_in_kernel_window s'a; cap_refs_in_kernel_window s'a; pspace_respects_device_region s'a; cap_refs_respects_device_region s'a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (return ()) (set_notification epptr (ntfn_set_obj ntfn_ext (ActiveNtfn badge)))
 2. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 3. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (2 subgoals):
 1. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 2. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (2 subgoals):
 1. \<And>s'a ntfn_ext x2. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 2. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (2 subgoals):
 1. \<And>s'a ntfn_ext x2 s'. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2; transform s'a = transform s'; s'a = s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_ntfn_recv_threads epptr (transform s')) >>= case_option (return ()) do_notification_transfer) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge'))
 2. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (2 subgoals):
 1. \<And>ntfn_ext x2 s'. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_ntfn_recv_threads epptr (transform s')) >>= case_option (return ()) do_notification_transfer) (update_waiting_ntfn epptr x2 (ntfn_bound_tcb ntfn_ext) badge)
 2. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (3 subgoals):
 1. \<And>ntfn_ext x2 s'. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2\<rbrakk> \<Longrightarrow> valid_objs s'
 2. \<And>ntfn_ext x2 s'. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2; valid_ntfn ntfn_ext s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_ntfn_recv_threads epptr (transform s')) >>= case_option (return ()) do_notification_transfer) (update_waiting_ntfn epptr x2 (ntfn_bound_tcb ntfn_ext) badge)
 3. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (2 subgoals):
 1. \<And>ntfn_ext x2 s'. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2; valid_ntfn ntfn_ext s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_ntfn_recv_threads epptr (transform s')) >>= case_option (return ()) do_notification_transfer) (update_waiting_ntfn epptr x2 (ntfn_bound_tcb ntfn_ext) badge)
 2. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (2 subgoals):
 1. \<And>ntfn_ext x2 s'. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2; valid_ntfn ntfn_ext s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if get_waiting_ntfn_recv_threads epptr (transform s') = {} then return None else do a <- select (get_waiting_ntfn_recv_threads epptr (transform s'));
return (Some a)
od) >>= case_option (return ()) do_notification_transfer) (update_waiting_ntfn epptr x2 (ntfn_bound_tcb ntfn_ext) badge)
 2. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (2 subgoals):
 1. \<And>ntfn_ext x2 s'. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2; valid_ntfn ntfn_ext s'; valid_ntfn_abstract ntfn_ext epptr s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if get_waiting_ntfn_recv_threads epptr (transform s') = {} then return None else do a <- select (get_waiting_ntfn_recv_threads epptr (transform s'));
return (Some a)
od) >>= case_option (return ()) do_notification_transfer) (update_waiting_ntfn epptr x2 (ntfn_bound_tcb ntfn_ext) badge)
 2. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (2 subgoals):
 1. \<And>ntfn_ext x2 s'. \<lbrakk>ep_id = epptr; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2; valid_ntfn ntfn_ext s'; valid_pspace s'; set_option (ntfn_bound_tcb ntfn_ext) = ntfn_bound_set epptr s'; valid_mdb s'; x2 \<noteq> []; valid_ioc s'; set x2 = ntfn_waiting_set epptr s'; \<forall>p'. Some (kernel_object.Notification ntfn_ext) = kheap s' p' \<longrightarrow> epptr = p'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'\<rbrakk> \<Longrightarrow> (ntfn_waiting_set epptr s' = {} \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (return ()) (update_waiting_ntfn epptr x2 (ntfn_bound_tcb ntfn_ext) badge)) \<and> (ntfn_waiting_set epptr s' \<noteq> {} \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (select (ntfn_waiting_set epptr s') >>= do_notification_transfer) (update_waiting_ntfn epptr x2 (ntfn_bound_tcb ntfn_ext) badge))
 2. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (3 subgoals):
 1. \<And>ntfn_ext x2 s'. \<lbrakk>ep_id = epptr; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2; valid_ntfn ntfn_ext s'; valid_pspace s'; set_option (ntfn_bound_tcb ntfn_ext) = ntfn_bound_set epptr s'; valid_mdb s'; x2 \<noteq> []; valid_ioc s'; set x2 = ntfn_waiting_set epptr s'; \<forall>p'. Some (kernel_object.Notification ntfn_ext) = kheap s' p' \<longrightarrow> epptr = p'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'\<rbrakk> \<Longrightarrow> ntfn_waiting_set epptr s' = {} \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (return ()) (update_waiting_ntfn epptr x2 (ntfn_bound_tcb ntfn_ext) badge)
 2. \<And>ntfn_ext x2 s'. \<lbrakk>ep_id = epptr; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2; valid_ntfn ntfn_ext s'; valid_pspace s'; set_option (ntfn_bound_tcb ntfn_ext) = ntfn_bound_set epptr s'; valid_mdb s'; x2 \<noteq> []; valid_ioc s'; set x2 = ntfn_waiting_set epptr s'; \<forall>p'. Some (kernel_object.Notification ntfn_ext) = kheap s' p' \<longrightarrow> epptr = p'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'\<rbrakk> \<Longrightarrow> ntfn_waiting_set epptr s' \<noteq> {} \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (select (ntfn_waiting_set epptr s') >>= do_notification_transfer) (update_waiting_ntfn epptr x2 (ntfn_bound_tcb ntfn_ext) badge)
 3. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (2 subgoals):
 1. \<And>ntfn_ext x2 s'. \<lbrakk>ep_id = epptr; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn x2; valid_ntfn ntfn_ext s'; valid_pspace s'; set_option (ntfn_bound_tcb ntfn_ext) = ntfn_bound_set epptr s'; valid_mdb s'; x2 \<noteq> []; valid_ioc s'; set x2 = ntfn_waiting_set epptr s'; \<forall>p'. Some (kernel_object.Notification ntfn_ext) = kheap s' p' \<longrightarrow> epptr = p'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'\<rbrakk> \<Longrightarrow> ntfn_waiting_set epptr s' \<noteq> {} \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (select (ntfn_waiting_set epptr s') >>= do_notification_transfer) (update_waiting_ntfn epptr x2 (ntfn_bound_tcb ntfn_ext) badge)
 2. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (2 subgoals):
 1. \<And>ntfn_ext s' y ys. \<lbrakk>ep_id = epptr; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn (y # ys); valid_ntfn ntfn_ext s'; valid_pspace s'; set_option (ntfn_bound_tcb ntfn_ext) = ntfn_bound_set epptr s'; valid_mdb s'; valid_ioc s'; insert y (set ys) = ntfn_waiting_set epptr s'; \<forall>p'. Some (kernel_object.Notification ntfn_ext) = kheap s' p' \<longrightarrow> epptr = p'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; ntfn_waiting_set epptr s' \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (select (ntfn_waiting_set epptr s') >>= do_notification_transfer) (update_waiting_ntfn epptr (y # ys) (ntfn_bound_tcb ntfn_ext) badge)
 2. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (4 subgoals):
 1. \<And>ntfn_ext s' y ys. \<lbrakk>ep_id = epptr; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn (y # ys); valid_ntfn ntfn_ext s'; valid_pspace s'; set_option (ntfn_bound_tcb ntfn_ext) = ntfn_bound_set epptr s'; valid_mdb s'; valid_ioc s'; insert y (set ys) = ntfn_waiting_set epptr s'; \<forall>p'. Some (kernel_object.Notification ntfn_ext) = kheap s' p' \<longrightarrow> epptr = p'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; ntfn_waiting_set epptr s' \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres dc (?Q444 ntfn_ext s' y ys) (?Q'444 ntfn_ext s' y ys) (select (ntfn_waiting_set epptr s') >>= do_notification_transfer) (update_waiting_ntfn epptr (y # ys) (ntfn_bound_tcb ntfn_ext) badge)
 2. \<And>ntfn_ext s' y ys s. \<lbrakk>ep_id = epptr; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn (y # ys); valid_ntfn ntfn_ext s'; valid_pspace s'; set_option (ntfn_bound_tcb ntfn_ext) = ntfn_bound_set epptr s'; valid_mdb s'; valid_ioc s'; insert y (set ys) = ntfn_waiting_set epptr s'; \<forall>p'. Some (kernel_object.Notification ntfn_ext) = kheap s' p' \<longrightarrow> epptr = p'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; ntfn_waiting_set epptr s' \<noteq> {}; transform s' = s\<rbrakk> \<Longrightarrow> ?Q444 ntfn_ext s' y ys s
 3. \<And>ntfn_ext s' y ys s. \<lbrakk>ep_id = epptr; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn (y # ys); valid_ntfn ntfn_ext s'; valid_pspace s'; set_option (ntfn_bound_tcb ntfn_ext) = ntfn_bound_set epptr s'; valid_mdb s'; valid_ioc s'; insert y (set ys) = ntfn_waiting_set epptr s'; \<forall>p'. Some (kernel_object.Notification ntfn_ext) = kheap s' p' \<longrightarrow> epptr = p'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; ntfn_waiting_set epptr s' \<noteq> {}; s' = s\<rbrakk> \<Longrightarrow> ?Q'444 ntfn_ext s' y ys s
 4. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (4 subgoals):
 1. \<And>ntfn_ext s' y ys. \<lbrakk>ep_id = epptr; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn (y # ys); valid_ntfn ntfn_ext s'; valid_pspace s'; set_option (ntfn_bound_tcb ntfn_ext) = ntfn_bound_set epptr s'; valid_mdb s'; valid_ioc s'; insert y (set ys) = ntfn_waiting_set epptr s'; \<forall>p'. Some (kernel_object.Notification ntfn_ext) = kheap s' p' \<longrightarrow> epptr = p'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; ntfn_waiting_set epptr s' \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres dc (?P448 ntfn_ext s' y ys) (?Q'444 ntfn_ext s' y ys) (do_notification_transfer (?x448 ntfn_ext s' y ys)) (update_waiting_ntfn epptr (y # ys) (ntfn_bound_tcb ntfn_ext) badge)
 2. \<And>ntfn_ext s' y ys s. \<lbrakk>ep_id = epptr; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn (y # ys); valid_ntfn ntfn_ext s'; valid_pspace s'; set_option (ntfn_bound_tcb ntfn_ext) = ntfn_bound_set epptr s'; valid_mdb s'; valid_ioc s'; insert y (set ys) = ntfn_waiting_set epptr s'; \<forall>p'. Some (kernel_object.Notification ntfn_ext) = kheap s' p' \<longrightarrow> epptr = p'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; ntfn_waiting_set epptr s' \<noteq> {}; transform s' = s\<rbrakk> \<Longrightarrow> (?P448 ntfn_ext s' y ys and (\<lambda>s. ?x448 ntfn_ext s' y ys \<in> ntfn_waiting_set epptr s')) s
 3. \<And>ntfn_ext s' y ys s. \<lbrakk>ep_id = epptr; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn (y # ys); valid_ntfn ntfn_ext s'; valid_pspace s'; set_option (ntfn_bound_tcb ntfn_ext) = ntfn_bound_set epptr s'; valid_mdb s'; valid_ioc s'; insert y (set ys) = ntfn_waiting_set epptr s'; \<forall>p'. Some (kernel_object.Notification ntfn_ext) = kheap s' p' \<longrightarrow> epptr = p'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; ntfn_waiting_set epptr s' \<noteq> {}; s' = s\<rbrakk> \<Longrightarrow> ?Q'444 ntfn_ext s' y ys s
 4. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (3 subgoals):
 1. \<And>ntfn_ext s' y ys s. \<lbrakk>ep_id = epptr; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn (y # ys); valid_ntfn ntfn_ext s'; valid_pspace s'; set_option (ntfn_bound_tcb ntfn_ext) = ntfn_bound_set epptr s'; valid_mdb s'; valid_ioc s'; insert y (set ys) = ntfn_waiting_set epptr s'; \<forall>p'. Some (kernel_object.Notification ntfn_ext) = kheap s' p' \<longrightarrow> epptr = p'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; ntfn_waiting_set epptr s' \<noteq> {}; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. y \<in> ntfn_waiting_set epptr s')) s
 2. \<And>ntfn_ext s' y ys s. \<lbrakk>ep_id = epptr; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn (y # ys); valid_ntfn ntfn_ext s'; valid_pspace s'; set_option (ntfn_bound_tcb ntfn_ext) = ntfn_bound_set epptr s'; valid_mdb s'; valid_ioc s'; insert y (set ys) = ntfn_waiting_set epptr s'; \<forall>p'. Some (kernel_object.Notification ntfn_ext) = kheap s' p' \<longrightarrow> epptr = p'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; ntfn_waiting_set epptr s' \<noteq> {}; s' = s\<rbrakk> \<Longrightarrow> (pspace_aligned and valid_objs and valid_mdb and pspace_distinct and valid_idle and valid_etcbs and st_tcb_at ((=) (BlockedOnNotification epptr)) y and valid_ntfn \<lparr>ntfn_obj = case ys of [] \<Rightarrow> IdleNtfn | a # list \<Rightarrow> WaitingNtfn ys, ntfn_bound_tcb = ntfn_bound_tcb ntfn_ext\<rparr>) s
 3. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (3 subgoals):
 1. \<And>ntfn_ext s' y ys s. \<lbrakk>ep_id = epptr; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn (y # ys); valid_ntfn ntfn_ext s'; valid_pspace s'; set_option (ntfn_bound_tcb ntfn_ext) = ntfn_bound_set epptr s'; valid_mdb s'; valid_ioc s'; \<forall>p'. Some (kernel_object.Notification ntfn_ext) = kheap s' p' \<longrightarrow> epptr = p'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; ntfn_waiting_set epptr s' \<noteq> {}; transform s' = s; ntfn_waiting_set epptr s' = insert y (set ys)\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. y \<in> ntfn_waiting_set epptr s')) s
 2. \<And>ntfn_ext s' y ys s. \<lbrakk>ep_id = epptr; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn (y # ys); valid_ntfn ntfn_ext s'; valid_pspace s'; set_option (ntfn_bound_tcb ntfn_ext) = ntfn_bound_set epptr s'; valid_mdb s'; valid_ioc s'; insert y (set ys) = ntfn_waiting_set epptr s'; \<forall>p'. Some (kernel_object.Notification ntfn_ext) = kheap s' p' \<longrightarrow> epptr = p'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; ntfn_waiting_set epptr s' \<noteq> {}; s' = s\<rbrakk> \<Longrightarrow> (pspace_aligned and valid_objs and valid_mdb and pspace_distinct and valid_idle and valid_etcbs and st_tcb_at ((=) (BlockedOnNotification epptr)) y and valid_ntfn \<lparr>ntfn_obj = case ys of [] \<Rightarrow> IdleNtfn | a # list \<Rightarrow> WaitingNtfn ys, ntfn_bound_tcb = ntfn_bound_tcb ntfn_ext\<rparr>) s
 3. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (2 subgoals):
 1. \<And>ntfn_ext s' y ys s. \<lbrakk>ep_id = epptr; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn (y # ys); valid_ntfn ntfn_ext s'; valid_pspace s'; set_option (ntfn_bound_tcb ntfn_ext) = ntfn_bound_set epptr s'; valid_mdb s'; valid_ioc s'; insert y (set ys) = ntfn_waiting_set epptr s'; \<forall>p'. Some (kernel_object.Notification ntfn_ext) = kheap s' p' \<longrightarrow> epptr = p'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; ntfn_waiting_set epptr s' \<noteq> {}; s' = s\<rbrakk> \<Longrightarrow> (pspace_aligned and valid_objs and valid_mdb and pspace_distinct and valid_idle and valid_etcbs and st_tcb_at ((=) (BlockedOnNotification epptr)) y and valid_ntfn \<lparr>ntfn_obj = case ys of [] \<Rightarrow> IdleNtfn | a # list \<Rightarrow> WaitingNtfn ys, ntfn_bound_tcb = ntfn_bound_tcb ntfn_ext\<rparr>) s
 2. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (2 subgoals):
 1. \<And>ntfn_ext s' y ys s. \<lbrakk>ep_id = epptr; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn (y # ys); valid_ntfn ntfn_ext s'; valid_pspace s'; set_option (ntfn_bound_tcb ntfn_ext) = ntfn_bound_set epptr s'; valid_mdb s'; valid_ioc s'; \<forall>p'. Some (kernel_object.Notification ntfn_ext) = kheap s' p' \<longrightarrow> epptr = p'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; ntfn_waiting_set epptr s' \<noteq> {}; s' = s; ntfn_waiting_set epptr s' = insert y (set ys)\<rbrakk> \<Longrightarrow> (pspace_aligned and valid_objs and valid_mdb and pspace_distinct and valid_idle and valid_etcbs and st_tcb_at ((=) (BlockedOnNotification epptr)) y and valid_ntfn \<lparr>ntfn_obj = case ys of [] \<Rightarrow> IdleNtfn | a # list \<Rightarrow> WaitingNtfn ys, ntfn_bound_tcb = ntfn_bound_tcb ntfn_ext\<rparr>) s
 2. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (2 subgoals):
 1. \<And>ntfn_ext s' y ys s. \<lbrakk>ep_id = epptr; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn (y # ys); valid_ntfn ntfn_ext s'; valid_pspace s'; set_option (ntfn_bound_tcb ntfn_ext) = ntfn_bound_set epptr s'; valid_mdb s'; valid_ioc s'; \<forall>p'. Some (kernel_object.Notification ntfn_ext) = kheap s' p' \<longrightarrow> epptr = p'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; ntfn_waiting_set epptr s' \<noteq> {}; s' = s; (y \<in> ntfn_waiting_set epptr s') = (y \<in> insert y (set ys))\<rbrakk> \<Longrightarrow> (pspace_aligned and valid_objs and valid_mdb and pspace_distinct and valid_idle and valid_etcbs and st_tcb_at ((=) (BlockedOnNotification epptr)) y and valid_ntfn \<lparr>ntfn_obj = case ys of [] \<Rightarrow> IdleNtfn | a # list \<Rightarrow> WaitingNtfn ys, ntfn_bound_tcb = ntfn_bound_tcb ntfn_ext\<rparr>) s
 2. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (2 subgoals):
 1. \<And>ntfn_ext y ys s x t ta. \<lbrakk>ep_id = epptr; cur_tcb s; valid_etcbs s; \<nexists>!y. False; kheap s epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = WaitingNtfn (y # ys); valid_ntfn ntfn_ext s; set_option (ntfn_bound_tcb ntfn_ext) = ntfn_bound_set epptr s; valid_mdb s; valid_ioc s; \<forall>p'. Some (kernel_object.Notification ntfn_ext) = kheap s p' \<longrightarrow> epptr = p'; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; valid_objs s; kheap s y = Some (TCB t); tcb_state t = BlockedOnNotification epptr; kheap s x = Some (TCB ta); tcb_state ta = BlockedOnNotification epptr; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> st_tcb_at ((=) (BlockedOnNotification epptr)) y s \<and> valid_ntfn \<lparr>ntfn_obj = case ys of [] \<Rightarrow> IdleNtfn | a # list \<Rightarrow> WaitingNtfn ys, ntfn_bound_tcb = ntfn_bound_tcb ntfn_ext\<rparr> s
 2. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (1 subgoal):
 1. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od \<sqinter> send_signal_bound epptr) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (1 subgoal):
 1. \<And>s'a ntfn_ext x3. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do s <- get;
option_select (get_waiting_ntfn_recv_threads epptr s) >>= case_option (return ()) do_notification_transfer
od) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (1 subgoal):
 1. \<And>s'a ntfn_ext x3 s'. \<lbrakk>ep_id = epptr; valid_state s'a; cur_tcb s'a; valid_etcbs s'a; \<nexists>!y. False; kheap s'a epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3; transform s'a = transform s'; s'a = s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_ntfn_recv_threads epptr (transform s')) >>= case_option (return ()) do_notification_transfer) (case ntfn_obj ntfn_ext of IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn_ext of None \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do IpcCancel_A.cancel_ipc tcb;
set_thread_state tcb Running;
as_user tcb $ setRegister badge_register badge;
do_extended_op (possible_switch_to tcb)
od else set_notification epptr $ ntfn_set_obj ntfn_ext (ActiveNtfn badge)
od | WaitingNtfn queue \<Rightarrow> update_waiting_ntfn epptr queue (ntfn_bound_tcb ntfn_ext) badge | ActiveNtfn badge' \<Rightarrow> set_notification epptr $ ntfn_set_obj ntfn_ext $ ActiveNtfn (combine_ntfn_badges badge badge')) proof (prove)
goal (1 subgoal):
 1. \<And>ntfn_ext x3 s'. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_ntfn_recv_threads epptr (transform s')) >>= case_option (return ()) do_notification_transfer) (set_notification epptr (ntfn_set_obj ntfn_ext (ActiveNtfn (combine_ntfn_badges badge x3)))) proof (prove)
goal (2 subgoals):
 1. \<And>ntfn_ext x3 s'. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3\<rbrakk> \<Longrightarrow> valid_objs s'
 2. \<And>ntfn_ext x3 s'. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3; valid_ntfn ntfn_ext s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_ntfn_recv_threads epptr (transform s')) >>= case_option (return ()) do_notification_transfer) (set_notification epptr (ntfn_set_obj ntfn_ext (ActiveNtfn (combine_ntfn_badges badge x3)))) proof (prove)
goal (1 subgoal):
 1. \<And>ntfn_ext x3 s'. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3; valid_ntfn ntfn_ext s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_ntfn_recv_threads epptr (transform s')) >>= case_option (return ()) do_notification_transfer) (set_notification epptr (ntfn_set_obj ntfn_ext (ActiveNtfn (combine_ntfn_badges badge x3)))) proof (prove)
goal (1 subgoal):
 1. \<And>ntfn_ext x3 s'. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3; valid_ntfn ntfn_ext s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if get_waiting_ntfn_recv_threads epptr (transform s') = {} then return None else do a <- select (get_waiting_ntfn_recv_threads epptr (transform s'));
return (Some a)
od) >>= case_option (return ()) do_notification_transfer) (set_notification epptr (ntfn_set_obj ntfn_ext (ActiveNtfn (combine_ntfn_badges badge x3)))) proof (prove)
goal (1 subgoal):
 1. \<And>ntfn_ext x3 s'. \<lbrakk>ep_id = epptr; valid_state s'; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3; valid_ntfn ntfn_ext s'; valid_ntfn_abstract ntfn_ext epptr s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if get_waiting_ntfn_recv_threads epptr (transform s') = {} then return None else do a <- select (get_waiting_ntfn_recv_threads epptr (transform s'));
return (Some a)
od) >>= case_option (return ()) do_notification_transfer) (set_notification epptr (ntfn_set_obj ntfn_ext (ActiveNtfn (combine_ntfn_badges badge x3)))) proof (prove)
goal (1 subgoal):
 1. \<And>ntfn_ext x3 s'. \<lbrakk>ep_id = epptr; cur_tcb s'; valid_etcbs s'; \<nexists>!y. False; kheap s' epptr = Some (kernel_object.Notification ntfn_ext); ntfn_obj ntfn_ext = ActiveNtfn x3; valid_ntfn ntfn_ext s'; valid_pspace s'; set_option (ntfn_bound_tcb ntfn_ext) = ntfn_bound_set epptr s'; ntfn_waiting_set epptr s' = {}; valid_mdb s'; valid_ioc s'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (return ()) (set_notification epptr (ntfn_set_obj ntfn_ext (ActiveNtfn (combine_ntfn_badges badge x3)))) proof (prove)
goal:
No subgoals!