theory Ipc_C

lemma sendSignal_ccorres [corres]:
  "ccorres dc xfdc (invs')
     (UNIV \<inter> \<lbrace>\<acute>ntfnPtr = Ptr ntfnptr\<rbrace> \<inter> \<lbrace>\<acute>badge = badge\<rbrace>) hs
     (sendSignal ntfnptr badge)
     (Call sendSignal_'proc)" apply (cinit lift: ntfnPtr_' badge_') apply (rule ccorres_pre_getNotification, rename_tac ntfn) apply (rule_tac xf'=ret__unsigned_'
               and val="case ntfnObj ntfn of IdleNtfn \<Rightarrow> scast NtfnState_Idle
                                 | WaitingNtfn _ \<Rightarrow> scast NtfnState_Waiting
                                 | ActiveNtfn _ \<Rightarrow> scast NtfnState_Active"
               and R="ko_at' ntfn ntfnptr"
                in ccorres_symb_exec_r_known_rv_UNIV[where R'=UNIV]) apply (vcg, clarsimp) apply (erule(1) cmap_relation_ko_atE [OF cmap_relation_ntfn]) apply (clarsimp simp: cnotification_relation_def Let_def typ_heap_simps
                     split: Structures_H.ntfn.splits) apply ceqv apply (rule_tac P="ntfnBoundTCB ntfn \<noteq> None \<longrightarrow>
                         option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL"
                 in ccorres_gen_asm) apply wpc
      \<comment> \<open>IdleNtfn case\<close> apply (rule ccorres_cond_true) apply (rule ccorres_rhs_assoc)+ apply (rule_tac xf'=ret__unsigned_'
                 and val="ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))"
                 and R="ko_at' ntfn ntfnptr"
                 in ccorres_symb_exec_r_known_rv_UNIV[where R'=UNIV]) apply (rule conseqPre, vcg) apply clarsimp apply (erule(1) cmap_relation_ko_atE [OF cmap_relation_ntfn]) apply (clarsimp simp: cnotification_relation_def Let_def typ_heap_simps
                        split: Structures_H.ntfn.splits) apply ceqv apply csymbr apply wpc apply (simp add: option_to_ctcb_ptr_def split del: if_split) apply (rule ccorres_cond_false) apply (ctac add: ntfn_set_active_ccorres) apply (rule ccorres_cond_true) apply (rule getThreadState_ccorres_foo) apply (rule ccorres_Guard_Seq) apply csymbr apply (rule ccorres_abstract_cleanup) apply (rule_tac P="(ret__unsigned = scast ThreadState_BlockedOnReceive)
                 = receiveBlocked rv" in ccorres_gen_asm2) apply (rule ccorres_cond[where R=\<top>]) apply (simp add: Collect_const_mem) apply (rule ccorres_rhs_assoc)+ apply simp apply (ctac(no_vcg) add: cancelIPC_ccorres1[OF cteDeleteOne_ccorres]) apply (ctac(no_vcg) add: setThreadState_ccorres) apply (ctac(no_vcg) add: setRegister_ccorres) apply (ctac add: possibleSwitchTo_ccorres) apply (wp sts_running_valid_queues sts_st_tcb_at'_cases
                 | simp add: option_to_ctcb_ptr_def split del: if_split)+ apply (rule_tac Q="\<lambda>_. tcb_at' (the (ntfnBoundTCB ntfn)) and invs'"
                 in hoare_post_imp) apply auto[1] apply wp apply simp apply (ctac add: ntfn_set_active_ccorres) apply (clarsimp simp: guard_is_UNIV_def option_to_ctcb_ptr_def
                            ARM_H.badgeRegister_def Kernel_C.badgeRegister_def
                            ARM.badgeRegister_def Kernel_C.R0_def
                            "StrictC'_thread_state_defs"less_mask_eq
                            Collect_const_mem) apply (case_tac ts, simp_all add: receiveBlocked_def typ_heap_simps
                       cthread_state_relation_def "StrictC'_thread_state_defs")[1]
      \<comment> \<open>ActiveNtfn case\<close> apply (rename_tac old_badge) apply (rule ccorres_cond_false) apply (rule ccorres_cond_false) apply (rule ccorres_cond_true) apply (clarsimp simp: setNotification_def) apply (rule_tac P="invs' and ko_at' ntfn ntfnptr"
                 and P'=UNIV
                  in ccorres_from_vcg) apply (rule allI) apply (rule conseqPre, vcg) apply clarsimp apply (frule(1) cmap_relation_ko_atD [OF cmap_relation_ntfn]) apply (clarsimp simp: typ_heap_simps) apply (rule bexI [OF _ setObject_eq]) apply (simp add: rf_sr_def cstate_relation_def Let_def
                          cpspace_relation_def update_ntfn_map_tos
                          typ_heap_simps') apply (elim conjE) apply (intro conjI) apply (rule cpspace_relation_ntfn_update_ntfn, assumption+) apply (simp add: cnotification_relation_def Let_def
                             NtfnState_Active_def mask_def word_bw_comms) apply simp apply (simp add: carch_state_relation_def typ_heap_simps') apply (simp add: cmachine_state_relation_def) apply (simp add: h_t_valid_clift_Some_iff) apply (simp add: objBits_simps') apply (simp add: objBits_simps) apply assumption
    \<comment> \<open>WaitingNtfn case\<close> apply (rule ccorres_cond_false) apply (rule ccorres_cond_true) apply wpc apply (simp only: haskell_fail_def) apply (rule ccorres_fail) apply (rename_tac dest rest) apply (intro ccorres_rhs_assoc) apply (csymbr, csymbr) apply (intro ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc) apply (rule ccorres_rhs_assoc) apply (rule ccorres_split_nothrow_novcg) apply (simp only: ) apply (rule_tac dest=dest in sendSignal_dequeue_ccorres_helper) apply ceqv apply (simp only: K_bind_def) apply (ctac (no_vcg)) apply simp apply (ctac (no_vcg)) apply (ctac add: possibleSwitchTo_ccorres) apply (simp) apply (wp weak_sch_act_wf_lift_linear
         setThreadState_oa_queued
         sts_valid_queues tcb_in_cur_domain'_lift)[1] apply (wp sts_valid_queues sts_runnable) apply (wp setThreadState_st_tcb set_ntfn_valid_objs' | clarsimp)+ apply (clarsimp simp: guard_is_UNIV_def ThreadState_Running_def mask_def
                          badgeRegister_def Kernel_C.badgeRegister_def
                          ARM.badgeRegister_def Kernel_C.R0_def) apply (clarsimp simp: guard_is_UNIV_def NtfnState_Idle_def
                         NtfnState_Active_def NtfnState_Waiting_def) apply clarsimp apply (simp only: conj_assoc[symmetric]) apply (rule conjI) apply (frule ko_at_valid_objs', (clarsimp simp: projectKOs)+) apply (clarsimp simp: valid_obj'_def) apply (auto simp: isWaitingNtfn_def st_tcb_at_refs_of_rev' valid_obj'_def valid_ntfn'_def
               dest!: sym_refs_obj_atD' [OF _ invs_sym']
                elim: pred_tcb'_weakenE
               split: list.splits option.splits)[1] apply (clarsimp simp: option_to_ctcb_ptr_def tcb_ptr_to_ctcb_ptr_def
                        ctcb_offset_defs
                 dest!: sum_to_zero) apply (frule (1) ko_at_valid_ntfn'[OF _ invs_valid_objs']) apply (auto simp: valid_ntfn'_def valid_bound_tcb'_def obj_at'_def projectKOs
                    objBits_simps' is_aligned_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc invs' (UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr ntfnptr\<rbrace> \<inter> \<lbrace>\<acute>badge = badge\<rbrace>) hs (sendSignal ntfnptr badge) (Call sendSignal_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>badgea ntfnPtr. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1833 badgea ntfnPtr) (?Q'1833 badgea ntfnPtr) (SKIP # hs) (do nTFN <- getNotification ntfnptr;
case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo tcb
od else setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (badge || badge');
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od
od) (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(ntfnPtr);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 2. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1833 badgea ntfnPtr s \<and> s' \<in> ?Q'1833 badgea ntfnPtr proof (prove)
goal (2 subgoals):
 1. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1839 badgea ntfnPtr ntfn) (?P'1839 badgea ntfnPtr ntfn) (SKIP # hs) (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB ntfn of None \<Rightarrow> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo tcb
od else setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (badge || badge');
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(ntfnPtr);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 2. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ?P1839 badgea ntfnPtr ntfn s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> ?P'1839 badgea ntfnPtr ntfn} proof (prove)
goal (5 subgoals):
 1. \<And>badgea ntfnPtr ntfn s. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. ko_at' ntfn ntfnptr s \<and> (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(ntfnPtr) ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)\<rbrace>)
 2. \<And>badgea ntfnPtr ntfn rv' t t'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI) (?y'1841 badgea ntfnPtr ntfn rv')
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1841 badgea ntfnPtr ntfn) (?Q1841 badgea ntfnPtr ntfn) (SKIP # hs) (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB ntfn of None \<Rightarrow> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo tcb
od else setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (badge || badge');
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (?y'1841 badgea ntfnPtr ntfn (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting))
 4. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. ?Q1841 badgea ntfnPtr ntfn)
 5. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> (?P1841 badgea ntfnPtr ntfn and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>ntfn s x. \<lbrakk>ko_at' ntfn ntfnptr s; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> notification_CL.state_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)
 2. \<And>badgea ntfnPtr ntfn rv' t t'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI) (?y'1841 badgea ntfnPtr ntfn rv')
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1841 badgea ntfnPtr ntfn) (?Q1841 badgea ntfnPtr ntfn) (SKIP # hs) (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB ntfn of None \<Rightarrow> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo tcb
od else setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (badge || badge');
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (?y'1841 badgea ntfnPtr ntfn (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting))
 4. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. ?Q1841 badgea ntfnPtr ntfn)
 5. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> (?P1841 badgea ntfnPtr ntfn and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>ntfn s x ko'. \<lbrakk>ko_at' ntfn ntfnptr s; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> notification_CL.state_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)
 2. \<And>badgea ntfnPtr ntfn rv' t t'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI) (?y'1841 badgea ntfnPtr ntfn rv')
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1841 badgea ntfnPtr ntfn) (?Q1841 badgea ntfnPtr ntfn) (SKIP # hs) (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB ntfn of None \<Rightarrow> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo tcb
od else setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (badge || badge');
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (?y'1841 badgea ntfnPtr ntfn (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting))
 4. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. ?Q1841 badgea ntfnPtr ntfn)
 5. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> (?P1841 badgea ntfnPtr ntfn and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>badgea ntfnPtr ntfn rv' t t'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI) (?y'1841 badgea ntfnPtr ntfn rv')
 2. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1841 badgea ntfnPtr ntfn) (?Q1841 badgea ntfnPtr ntfn) (SKIP # hs) (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB ntfn of None \<Rightarrow> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo tcb
od else setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (badge || badge');
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (?y'1841 badgea ntfnPtr ntfn (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting))
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. ?Q1841 badgea ntfnPtr ntfn)
 4. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> (?P1841 badgea ntfnPtr ntfn and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1841 badgea ntfnPtr ntfn) (?Q1841 badgea ntfnPtr ntfn) (SKIP # hs) (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB ntfn of None \<Rightarrow> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo tcb
od else setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (badge || badge');
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 2. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. ?Q1841 badgea ntfnPtr ntfn)
 3. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> (?P1841 badgea ntfnPtr ntfn and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G2308 badgea ntfnPtr ntfn) (?Q1841 badgea ntfnPtr ntfn) (SKIP # hs) (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB ntfn of None \<Rightarrow> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo tcb
od else setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (badge || badge');
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 2. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. ?Q1841 badgea ntfnPtr ntfn)
 3. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> (?G2308 badgea ntfnPtr ntfn and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2320 badgea ntfnPtr ntfn) (?R''2323 badgea ntfnPtr ntfn) (SKIP # hs) (case ntfnBoundTCB ntfn of None \<Rightarrow> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo tcb
od else setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 2. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 3. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 4. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> ?R''2323 badgea ntfnPtr ntfn} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 5. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ?R2320 badgea ntfnPtr ntfn s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2320 badgea ntfnPtr ntfn) (?R'2328 badgea ntfnPtr ntfn) (SKIP # hs) (case ntfnBoundTCB ntfn of None \<Rightarrow> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo tcb
od else setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn
od) (\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI)
 2. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 3. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 4. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> ?R'2328 badgea ntfnPtr ntfn \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 5. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ?R2320 badgea ntfnPtr ntfn s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2320 badgea ntfnPtr ntfn) (?R'2328 badgea ntfnPtr ntfn) (SKIP # hs) (case ntfnBoundTCB ntfn of None \<Rightarrow> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo tcb
od else setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn
od) (\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
(\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI))
 2. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 3. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 4. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> ?R'2328 badgea ntfnPtr ntfn \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 5. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ?R2320 badgea ntfnPtr ntfn s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>badgea ntfnPtr ntfn s. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. ko_at' ntfn ntfnptr s \<and> (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr) ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace>)
 2. \<And>badgea ntfnPtr ntfn rv' t t'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI) (?y'2332 badgea ntfnPtr ntfn rv')
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2332 badgea ntfnPtr ntfn) (?Q2332 badgea ntfnPtr ntfn) (SKIP # hs) (case ntfnBoundTCB ntfn of None \<Rightarrow> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo tcb
od else setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn
od) (?y'2332 badgea ntfnPtr ntfn (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))
 4. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. ?Q2332 badgea ntfnPtr ntfn)
 5. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 6. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 7. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 8. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (?P2332 badgea ntfnPtr ntfn and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>badgea ntfnPtr ntfn s. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> UNIV \<inter> {s'. ko_at' ntfn ntfnptr s \<and> (s, s') \<in> rf_sr} \<subseteq> {sa. sa \<Turnstile>\<^sub>c ntfnPtr \<and> (\<forall>t. ret__unsigned_' t = ntfnBoundTCB_CL (notification_lift (the (cslift sa ntfnPtr))) \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := ntfnBoundTCB_CL (notification_lift (the (cslift sa ntfnPtr)))\<rparr>) \<in> rf_sr \<and> ntfnBoundTCB_CL (notification_lift (the (cslift sa ntfnPtr))) = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))}
 2. \<And>badgea ntfnPtr ntfn rv' t t'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI) (?y'2332 badgea ntfnPtr ntfn rv')
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2332 badgea ntfnPtr ntfn) (?Q2332 badgea ntfnPtr ntfn) (SKIP # hs) (case ntfnBoundTCB ntfn of None \<Rightarrow> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo tcb
od else setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn
od) (?y'2332 badgea ntfnPtr ntfn (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))
 4. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. ?Q2332 badgea ntfnPtr ntfn)
 5. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 6. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 7. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 8. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (?P2332 badgea ntfnPtr ntfn and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>ntfn s x. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ko_at' ntfn ntfnptr s; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> ((\<exists>t. ret__unsigned_' t = ntfnBoundTCB_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<longrightarrow> ntfnBoundTCB_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))
 2. \<And>badgea ntfnPtr ntfn rv' t t'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI) (?y'2332 badgea ntfnPtr ntfn rv')
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2332 badgea ntfnPtr ntfn) (?Q2332 badgea ntfnPtr ntfn) (SKIP # hs) (case ntfnBoundTCB ntfn of None \<Rightarrow> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo tcb
od else setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn
od) (?y'2332 badgea ntfnPtr ntfn (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))
 4. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. ?Q2332 badgea ntfnPtr ntfn)
 5. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 6. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 7. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 8. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (?P2332 badgea ntfnPtr ntfn and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>ntfn s x ko'. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ko_at' ntfn ntfnptr s; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> ((\<exists>t. ret__unsigned_' t = ntfnBoundTCB_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<longrightarrow> ntfnBoundTCB_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))
 2. \<And>badgea ntfnPtr ntfn rv' t t'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI) (?y'2332 badgea ntfnPtr ntfn rv')
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2332 badgea ntfnPtr ntfn) (?Q2332 badgea ntfnPtr ntfn) (SKIP # hs) (case ntfnBoundTCB ntfn of None \<Rightarrow> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo tcb
od else setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn
od) (?y'2332 badgea ntfnPtr ntfn (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))
 4. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. ?Q2332 badgea ntfnPtr ntfn)
 5. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 6. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 7. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 8. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (?P2332 badgea ntfnPtr ntfn and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>badgea ntfnPtr ntfn rv' t t'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI) (?y'2332 badgea ntfnPtr ntfn rv')
 2. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2332 badgea ntfnPtr ntfn) (?Q2332 badgea ntfnPtr ntfn) (SKIP # hs) (case ntfnBoundTCB ntfn of None \<Rightarrow> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo tcb
od else setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn
od) (?y'2332 badgea ntfnPtr ntfn (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. ?Q2332 badgea ntfnPtr ntfn)
 4. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 5. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 6. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 7. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (?P2332 badgea ntfnPtr ntfn and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2332 badgea ntfnPtr ntfn) (?Q2332 badgea ntfnPtr ntfn) (SKIP # hs) (case ntfnBoundTCB ntfn of None \<Rightarrow> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo tcb
od else setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn
od) (\<acute>tcb :== tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)));;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI)
 2. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. ?Q2332 badgea ntfnPtr ntfn)
 3. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 4. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 5. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 6. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (?P2332 badgea ntfnPtr ntfn and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2332 badgea ntfnPtr ntfn) (?G'2470 badgea ntfnPtr ntfn) (SKIP # hs) (case ntfnBoundTCB ntfn of None \<Rightarrow> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo tcb
od else setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn
od) (IF tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))));;
CALL setThreadState_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI)
 2. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))) s \<in> ?G'2470 badgea ntfnPtr ntfn})
 3. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 4. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 5. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 6. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (?P2332 badgea ntfnPtr ntfn and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2690 badgea ntfnPtr ntfn) (?R''2692 badgea ntfnPtr ntfn) (SKIP # hs) (setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn) (IF tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))));;
CALL setThreadState_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI)
 2. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2691 badgea ntfnPtr ntfn x2) (?R''2693 badgea ntfnPtr ntfn x2) (SKIP # hs) (do state <- getThreadState x2;
if receiveBlocked state then do cancelIPC x2;
setThreadState Structures_H.thread_state.Running x2;
asUser x2 $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo x2
od else setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn
od) (IF tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))));;
CALL setThreadState_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI)
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))) s \<in> {s. ntfnBoundTCB ntfn = None \<longrightarrow> s \<in> ?R''2692 badgea ntfnPtr ntfn} \<inter> {s. \<forall>x. s \<in> {s. ntfnBoundTCB ntfn = Some x \<longrightarrow> s \<in> ?R''2693 badgea ntfnPtr ntfn x}}})
 4. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 5. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 6. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 7. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> ?R2690 badgea ntfnPtr ntfn s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> ?R2691 badgea ntfnPtr ntfn x s)) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2690 badge (ntfn_Ptr ntfnptr) ntfn) (?R''2692 badge (ntfn_Ptr ntfnptr) ntfn) (SKIP # hs) (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn)) (Cond {} (Guard C_Guard {} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(NULL\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(NULL);;
CALL setThreadState_'proc(NULL,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(NULL,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge);;
CALL possibleSwitchTo_'proc(NULL)
ELSE
  CALL ntfn_set_active_'proc(ntfn_Ptr ntfnptr,badge)
FI) (CALL ntfn_set_active_'proc(ntfn_Ptr ntfnptr,badge)))
 2. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2691 badgea ntfnPtr ntfn x2) (?R''2693 badgea ntfnPtr ntfn x2) (SKIP # hs) (do state <- getThreadState x2;
if receiveBlocked state then do cancelIPC x2;
setThreadState Structures_H.thread_state.Running x2;
asUser x2 $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo x2
od else setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn
od) (IF tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))));;
CALL setThreadState_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI)
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))) s \<in> {s. ntfnBoundTCB ntfn = None \<longrightarrow> s \<in> ?R''2692 badgea ntfnPtr ntfn} \<inter> {s. \<forall>x. s \<in> {s. ntfnBoundTCB ntfn = Some x \<longrightarrow> s \<in> ?R''2693 badgea ntfnPtr ntfn x}}})
 4. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 5. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 6. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 7. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> ?R2690 badgea ntfnPtr ntfn s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> ?R2691 badgea ntfnPtr ntfn x s)) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2690 badge (ntfn_Ptr ntfnptr) ntfn) (?R'2705 badge (ntfn_Ptr ntfnptr) ntfn) (SKIP # hs) (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn)) (CALL ntfn_set_active_'proc(ntfn_Ptr ntfnptr,badge))
 2. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2691 badgea ntfnPtr ntfn x2) (?R''2693 badgea ntfnPtr ntfn x2) (SKIP # hs) (do state <- getThreadState x2;
if receiveBlocked state then do cancelIPC x2;
setThreadState Structures_H.thread_state.Running x2;
asUser x2 $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo x2
od else setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn
od) (IF tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))));;
CALL setThreadState_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI)
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))) s \<in> {s. ntfnBoundTCB ntfn = None \<longrightarrow> s \<in> ?R'2705 badgea ntfnPtr ntfn \<inter> - {}} \<inter> {s. \<forall>x. s \<in> {s. ntfnBoundTCB ntfn = Some x \<longrightarrow> s \<in> ?R''2693 badgea ntfnPtr ntfn x}}})
 4. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 5. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 6. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 7. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> ?R2690 badgea ntfnPtr ntfn s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> ?R2691 badgea ntfnPtr ntfn x s)) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2691 badgea ntfnPtr ntfn x2) (?R''2693 badgea ntfnPtr ntfn x2) (SKIP # hs) (do state <- getThreadState x2;
if receiveBlocked state then do cancelIPC x2;
setThreadState Structures_H.thread_state.Running x2;
asUser x2 $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo x2
od else setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn
od) (IF tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))));;
CALL setThreadState_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI)
 2. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))) s \<in> {s. ntfnBoundTCB ntfn = None \<longrightarrow> s \<in> {s. badge_'_update (\<lambda>_. badgea) (ntfnPtr_'_update (\<lambda>_. ntfnPtr) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfnPtr\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace>} \<inter> - {}} \<inter> {s. \<forall>x. s \<in> {s. ntfnBoundTCB ntfn = Some x \<longrightarrow> s \<in> ?R''2693 badgea ntfnPtr ntfn x}}})
 3. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 4. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 5. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 6. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> ?R2691 badgea ntfnPtr ntfn x s)) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2691 badgea ntfnPtr ntfn x2) (?R'2721 badgea ntfnPtr ntfn x2) (SKIP # hs) (do state <- getThreadState x2;
if receiveBlocked state then do cancelIPC x2;
setThreadState Structures_H.thread_state.Running x2;
asUser x2 $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo x2
od else setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))));;
CALL setThreadState_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI)
 2. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))) s \<in> {s. ntfnBoundTCB ntfn = None \<longrightarrow> s \<in> {s. badge_'_update (\<lambda>_. badgea) (ntfnPtr_'_update (\<lambda>_. ntfnPtr) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfnPtr\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace>} \<inter> - {}} \<inter> {s. \<forall>x. s \<in> {s. ntfnBoundTCB ntfn = Some x \<longrightarrow> s \<in> ?R'2721 badgea ntfnPtr ntfn x \<inter> \<lbrace>tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) \<noteq> NULL\<rbrace>}}})
 3. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 4. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 5. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 6. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> ?R2691 badgea ntfnPtr ntfn x s)) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>badgea ntfnPtr ntfn x2 rv. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2723 badgea ntfnPtr ntfn x2 rv) (?P'2723 badgea ntfnPtr ntfn x2 rv) (SKIP # hs) (if receiveBlocked rv then do cancelIPC x2;
setThreadState Structures_H.thread_state.Running x2;
asUser x2 $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo x2
od else setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))));;
CALL setThreadState_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI)
 2. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))) s \<in> {s. ntfnBoundTCB ntfn = None \<longrightarrow> s \<in> {s. badge_'_update (\<lambda>_. badgea) (ntfnPtr_'_update (\<lambda>_. ntfnPtr) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfnPtr\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace>} \<inter> - {}} \<inter> {s. \<forall>x. s \<in> {s. ntfnBoundTCB ntfn = Some x \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr x) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'2723 badgea ntfnPtr ntfn x ts} \<inter> \<lbrace>tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) \<noteq> NULL\<rbrace>}}})
 3. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 4. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 5. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 6. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ?P2723 badgea ntfnPtr ntfn x ts s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>badgea ntfnPtr ntfn x2 rv. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2723 badgea ntfnPtr ntfn x2 rv) (?C'2725 badgea ntfnPtr ntfn x2 rv) (SKIP # hs) (if receiveBlocked rv then do cancelIPC x2;
setThreadState Structures_H.thread_state.Running x2;
asUser x2 $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo x2
od else setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn) (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C'']));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))));;
CALL setThreadState_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI)
 2. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))) s \<in> {s. ntfnBoundTCB ntfn = None \<longrightarrow> s \<in> {s. badge_'_update (\<lambda>_. badgea) (ntfnPtr_'_update (\<lambda>_. ntfnPtr) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfnPtr\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace>} \<inter> - {}} \<inter> {s. \<forall>x. s \<in> {s. ntfnBoundTCB ntfn = Some x \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr x) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?C'2725 badgea ntfnPtr ntfn x ts \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))}} \<inter> \<lbrace>tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) \<noteq> NULL\<rbrace>}}})
 3. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 4. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 5. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 6. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ?P2723 badgea ntfnPtr ntfn x ts s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2723 badgea ntfnPtr ntfn x2 rv) (?G'2730 badgea ntfnPtr ntfn x2 rv ret__unsigned \<inter> {s. ret__unsigned = tsType_CL (thread_state_lift (tcbState_C (the (cslift s (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))))}) (SKIP # hs) (if receiveBlocked rv then do cancelIPC x2;
setThreadState Structures_H.thread_state.Running x2;
asUser x2 $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo x2
od else setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))));;
CALL setThreadState_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI)
 2. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))) s \<in> {s. ntfnBoundTCB ntfn = None \<longrightarrow> s \<in> {s. badge_'_update (\<lambda>_. badgea) (ntfnPtr_'_update (\<lambda>_. ntfnPtr) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfnPtr\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace>} \<inter> - {}} \<inter> {s. \<forall>x. s \<in> {s. ntfnBoundTCB ntfn = Some x \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr x) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v v'. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> ?G'2730 badgea ntfnPtr ntfn x ts v}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))}} \<inter> \<lbrace>tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) \<noteq> NULL\<rbrace>}}})
 3. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 4. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 5. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 6. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ?P2723 badgea ntfnPtr ntfn x ts s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2723 badgea ntfnPtr ntfn x2 rv) (?G'2881 badgea ntfnPtr ntfn x2 rv ret__unsigned) (SKIP # hs) (if receiveBlocked rv then do cancelIPC x2;
setThreadState Structures_H.thread_state.Running x2;
asUser x2 $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo x2
od else setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))));;
CALL setThreadState_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI)
 2. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))) s \<in> {s. ntfnBoundTCB ntfn = None \<longrightarrow> s \<in> {s. badge_'_update (\<lambda>_. badgea) (ntfnPtr_'_update (\<lambda>_. ntfnPtr) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfnPtr\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace>} \<inter> - {}} \<inter> {s. \<forall>x. s \<in> {s. ntfnBoundTCB ntfn = Some x \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr x) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v v'. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift s (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))))} \<longrightarrow> s \<in> ?G'2881 badgea ntfnPtr ntfn x ts v}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))}} \<inter> \<lbrace>tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) \<noteq> NULL\<rbrace>}}})
 3. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 4. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 5. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 6. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ?P2723 badgea ntfnPtr ntfn x ts s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2723 badgea ntfnPtr ntfn x2 rv) (?G'2883 badgea ntfnPtr ntfn x2 rv ret__unsigned) (SKIP # hs) (if receiveBlocked rv then do cancelIPC x2;
setThreadState Structures_H.thread_state.Running x2;
asUser x2 $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo x2
od else setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))));;
CALL setThreadState_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI)
 2. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))) s \<in> {s. ntfnBoundTCB ntfn = None \<longrightarrow> s \<in> {s. badge_'_update (\<lambda>_. badgea) (ntfnPtr_'_update (\<lambda>_. ntfnPtr) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfnPtr\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace>} \<inter> - {}} \<inter> {s. \<forall>x. s \<in> {s. ntfnBoundTCB ntfn = Some x \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr x) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v v'. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift s (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))))} \<longrightarrow> s \<in> ?G'2883 badgea ntfnPtr ntfn x ts v \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked ts\<rbrace>}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))}} \<inter> \<lbrace>tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) \<noteq> NULL\<rbrace>}}})
 3. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 4. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 5. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 6. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ?P2723 badgea ntfnPtr ntfn x ts s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<longrightarrow> receiveBlocked rv = (s' \<in> \<lbrace>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive\<rbrace>)
 2. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt2886 badgea ntfnPtr ntfn x2 rv) (?Rt2884 badgea ntfnPtr ntfn x2 rv ret__unsigned) (SKIP # hs) (do cancelIPC x2;
setThreadState Structures_H.thread_state.Running x2;
asUser x2 $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo x2
od) (CALL cancelIPC_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))));;
CALL setThreadState_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))))
 3. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf2888 badgea ntfnPtr ntfn x2 rv) (?Rf2884 badgea ntfnPtr ntfn x2 rv ret__unsigned) (SKIP # hs) (setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn) (CALL ntfn_set_active_'proc(ntfnPtr,badgea))
 4. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))) s \<in> {s. ntfnBoundTCB ntfn = None \<longrightarrow> s \<in> {s. badge_'_update (\<lambda>_. badgea) (ntfnPtr_'_update (\<lambda>_. ntfnPtr) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfnPtr\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace>} \<inter> - {}} \<inter> {s. \<forall>x. s \<in> {s. ntfnBoundTCB ntfn = Some x \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr x) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v v'. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift s (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))))} \<longrightarrow> s \<in> (?Rt2884 badgea ntfnPtr ntfn x ts v \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive\<rbrace> \<union> ?Rf2884 badgea ntfnPtr ntfn x ts v \<inter> - \<lbrace>v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive\<rbrace>) \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked ts\<rbrace>}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))}} \<inter> \<lbrace>tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) \<noteq> NULL\<rbrace>}}})
 5. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 6. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 7. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 8. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> ?Pt2886 badgea ntfnPtr ntfn x ts s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> ?Pf2888 badgea ntfnPtr ntfn x ts s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt2886 badgea ntfnPtr ntfn x2 rv) (?Rt2884 badgea ntfnPtr ntfn x2 rv ret__unsigned) (SKIP # hs) (do cancelIPC x2;
setThreadState Structures_H.thread_state.Running x2;
asUser x2 $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo x2
od) (CALL cancelIPC_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))));;
CALL setThreadState_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))))
 2. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf2888 badgea ntfnPtr ntfn x2 rv) (?Rf2884 badgea ntfnPtr ntfn x2 rv ret__unsigned) (SKIP # hs) (setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn) (CALL ntfn_set_active_'proc(ntfnPtr,badgea))
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))) s \<in> {s. ntfnBoundTCB ntfn = None \<longrightarrow> s \<in> {s. badge_'_update (\<lambda>_. badgea) (ntfnPtr_'_update (\<lambda>_. ntfnPtr) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfnPtr\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace>} \<inter> - {}} \<inter> {s. \<forall>x. s \<in> {s. ntfnBoundTCB ntfn = Some x \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr x) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v v'. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift s (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))))} \<longrightarrow> s \<in> (?Rt2884 badgea ntfnPtr ntfn x ts v \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive\<rbrace> \<union> ?Rf2884 badgea ntfnPtr ntfn x ts v \<inter> - \<lbrace>v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive\<rbrace>) \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked ts\<rbrace>}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))}} \<inter> \<lbrace>tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) \<noteq> NULL\<rbrace>}}})
 4. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 5. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 6. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 7. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> ?Pt2886 badgea ntfnPtr ntfn x ts s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> ?Pf2888 badgea ntfnPtr ntfn x ts s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt2886 badgea ntfnPtr ntfn x2 rv) (?Rt2884 badgea ntfnPtr ntfn x2 rv ret__unsigned) (SKIP # hs) (do cancelIPC x2;
setThreadState Structures_H.thread_state.Running x2;
asUser x2 $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo x2
od) (CALL cancelIPC_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))));;
(CALL setThreadState_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL setRegister_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))),SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))))))
 2. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf2888 badgea ntfnPtr ntfn x2 rv) (?Rf2884 badgea ntfnPtr ntfn x2 rv ret__unsigned) (SKIP # hs) (setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn) (CALL ntfn_set_active_'proc(ntfnPtr,badgea))
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))) s \<in> {s. ntfnBoundTCB ntfn = None \<longrightarrow> s \<in> {s. badge_'_update (\<lambda>_. badgea) (ntfnPtr_'_update (\<lambda>_. ntfnPtr) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfnPtr\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace>} \<inter> - {}} \<inter> {s. \<forall>x. s \<in> {s. ntfnBoundTCB ntfn = Some x \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr x) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v v'. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift s (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))))} \<longrightarrow> s \<in> (?Rt2884 badgea ntfnPtr ntfn x ts v \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive\<rbrace> \<union> ?Rf2884 badgea ntfnPtr ntfn x ts v \<inter> - \<lbrace>v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive\<rbrace>) \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked ts\<rbrace>}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))}} \<inter> \<lbrace>tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) \<noteq> NULL\<rbrace>}}})
 4. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 5. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 6. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 7. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> ?Pt2886 badgea ntfnPtr ntfn x ts s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> ?Pf2888 badgea ntfnPtr ntfn x ts s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; option_to_ctcb_ptr (Some x2) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt2886 badge (ntfn_Ptr ntfnptr) ntfn x2 rv) (?Rt2884 badge (ntfn_Ptr ntfnptr) ntfn x2 rv ret__unsigned) (SKIP # hs) (do y <- cancelIPC x2;
y <- setThreadState Structures_H.thread_state.Running x2;
y <- asUser x2 (setRegister Notification_H.badgeRegister badge);
possibleSwitchTo x2
od) (CALL cancelIPC_'proc(option_to_ctcb_ptr (Some x2));;
(CALL setThreadState_'proc(option_to_ctcb_ptr (Some x2),SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL setRegister_'proc(option_to_ctcb_ptr (Some x2),SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge);;
CALL possibleSwitchTo_'proc(option_to_ctcb_ptr (Some x2)))))
 2. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf2888 badgea ntfnPtr ntfn x2 rv) (?Rf2884 badgea ntfnPtr ntfn x2 rv ret__unsigned) (SKIP # hs) (setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn) (CALL ntfn_set_active_'proc(ntfnPtr,badgea))
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))) s \<in> {s. ntfnBoundTCB ntfn = None \<longrightarrow> s \<in> {s. badge_'_update (\<lambda>_. badgea) (ntfnPtr_'_update (\<lambda>_. ntfnPtr) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfnPtr\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace>} \<inter> - {}} \<inter> {s. \<forall>x. s \<in> {s. ntfnBoundTCB ntfn = Some x \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr x) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v v'. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift s (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))))} \<longrightarrow> s \<in> (?Rt2884 badgea ntfnPtr ntfn x ts v \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive\<rbrace> \<union> ?Rf2884 badgea ntfnPtr ntfn x ts v \<inter> - \<lbrace>v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive\<rbrace>) \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked ts\<rbrace>}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))}} \<inter> \<lbrace>tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) \<noteq> NULL\<rbrace>}}})
 4. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 5. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 6. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 7. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> ?Pt2886 badgea ntfnPtr ntfn x ts s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> ?Pf2888 badgea ntfnPtr ntfn x ts s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned rva xfdca. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; option_to_ctcb_ptr (Some x2) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv; dc rva xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2900 badgea ntfnPtr ntfn x2 rv ret__unsigned rva) (?Q'2916 ntfn x2 rv ret__unsigned rva xfdca) (SKIP # hs) (do y <- setThreadState Structures_H.thread_state.Running x2;
y <- asUser x2 (setRegister Notification_H.badgeRegister badge);
possibleSwitchTo x2
od) (CALL setThreadState_'proc(option_to_ctcb_ptr (Some x2),SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL setRegister_'proc(option_to_ctcb_ptr (Some x2),SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge);;
CALL possibleSwitchTo_'proc(option_to_ctcb_ptr (Some x2))))
 2. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; option_to_ctcb_ptr (Some x2) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv\<rbrakk> \<Longrightarrow> \<lbrace>?R2909 badge (ntfn_Ptr ntfnptr) ntfn x2 rv\<rbrace> cancelIPC x2 \<lbrace>?Q2900 badgea ntfnPtr ntfn x2 rv ret__unsigned\<rbrace>
 3. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf2888 badgea ntfnPtr ntfn x2 rv) (?Rf2884 badgea ntfnPtr ntfn x2 rv ret__unsigned) (SKIP # hs) (setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn) (CALL ntfn_set_active_'proc(ntfnPtr,badgea))
 4. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))) s \<in> {s. ntfnBoundTCB ntfn = None \<longrightarrow> s \<in> {s. badge_'_update (\<lambda>_. badgea) (ntfnPtr_'_update (\<lambda>_. ntfnPtr) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfnPtr\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace>} \<inter> - {}} \<inter> {s. \<forall>x. s \<in> {s. ntfnBoundTCB ntfn = Some x \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr x) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v v'. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift s (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))))} \<longrightarrow> s \<in> ({s. tptr_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s \<in> UNIV \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr x\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'2915 badgea ntfnPtr ntfn x ts v t rv} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive\<rbrace> \<union> ?Rf2884 badgea ntfnPtr ntfn x ts v \<inter> - \<lbrace>v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive\<rbrace>) \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked ts\<rbrace>}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))}} \<inter> \<lbrace>tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) \<noteq> NULL\<rbrace>}}})
 5. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 6. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 7. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 8. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and ?R2909 badgea ntfnPtr ntfn x ts) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> ?Pf2888 badgea ntfnPtr ntfn x ts s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}
flex-flex pairs:
\<lambda>ntfn x2 rv ret__unsigned t rva. ?Q'2916 ntfn x2 rv ret__unsigned rva (xfdc t) \<equiv>\<^sup>? ?Q'2915 badge (ntfn_Ptr ntfnptr) proof (prove)
goal (9 subgoals):
 1. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; option_to_ctcb_ptr (Some x2) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2951 badgea ntfnPtr ntfn x2 rv ret__unsigned rva xfdca rvb) (?Q'2970 ntfn x2 rv ret__unsigned rva xfdca rvb xfdcb) (SKIP # hs) (do y <- asUser x2 (setRegister Notification_H.badgeRegister badge);
possibleSwitchTo x2
od) (CALL setRegister_'proc(option_to_ctcb_ptr (Some x2),SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge);;
CALL possibleSwitchTo_'proc(option_to_ctcb_ptr (Some x2)))
 2. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned rva xfdc. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; option_to_ctcb_ptr (Some x2) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2965 badgea ntfnPtr ntfn x2 rv ret__unsigned rva\<rbrace> setThreadState Structures_H.thread_state.Running x2 \<lbrace>?Q2951 badgea ntfnPtr ntfn x2 rv ret__unsigned rva xfdc\<rbrace>
 3. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; option_to_ctcb_ptr (Some x2) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv\<rbrakk> \<Longrightarrow> \<lbrace>?R2909 badge (ntfn_Ptr ntfnptr) ntfn x2 rv\<rbrace> cancelIPC x2 \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' x2 a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread x2 \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. x2 \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R2965 badgea ntfnPtr ntfn x2 rv ret__unsigned a\<rbrace>
 4. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf2888 badgea ntfnPtr ntfn x2 rv) (?Rf2884 badgea ntfnPtr ntfn x2 rv ret__unsigned) (SKIP # hs) (setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn) (CALL ntfn_set_active_'proc(ntfnPtr,badgea))
 5. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))) s \<in> {s. ntfnBoundTCB ntfn = None \<longrightarrow> s \<in> {s. badge_'_update (\<lambda>_. badgea) (ntfnPtr_'_update (\<lambda>_. ntfnPtr) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfnPtr\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace>} \<inter> - {}} \<inter> {s. \<forall>x. s \<in> {s. ntfnBoundTCB ntfn = Some x \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr x) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v v'. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift s (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))))} \<longrightarrow> s \<in> ({s. tptr_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s \<in> UNIV \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr x\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr x\<rbrace>} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?Q'2971 badgea ntfnPtr ntfn x ts v t rv ta rva}} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive\<rbrace> \<union> ?Rf2884 badgea ntfnPtr ntfn x ts v \<inter> - \<lbrace>v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive\<rbrace>) \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked ts\<rbrace>}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))}} \<inter> \<lbrace>tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) \<noteq> NULL\<rbrace>}}})
 6. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 7. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 8. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 9. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and ?R2909 badgea ntfnPtr ntfn x ts) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> ?Pf2888 badgea ntfnPtr ntfn x ts s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}
flex-flex pairs:
?Q'2971 badge (ntfn_Ptr ntfnptr) \<equiv>\<^sup>? \<lambda>ntfn x2 rv ret__unsigned t rva ta rvb. ?Q'2970 ntfn x2 rv ret__unsigned rva (xfdc t) rvb (xfdc ta) proof (prove)
goal (10 subgoals):
 1. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned rva xfdca rvb xfdcb rvc xfdcc. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; option_to_ctcb_ptr (Some x2) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv; dc rva xfdca; dc rvb xfdcb; dc rvc xfdcc\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3007 badgea ntfnPtr ntfn x2 rv ret__unsigned rva xfdca rvb xfdcb rvc) (?Q'3026 ntfn x2 rv ret__unsigned rva xfdca rvb xfdcb rvc xfdcc) (SKIP # hs) (possibleSwitchTo x2) (CALL possibleSwitchTo_'proc(option_to_ctcb_ptr (Some x2)))
 2. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned rva xfdca rvb xfdc. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; option_to_ctcb_ptr (Some x2) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3021 badgea ntfnPtr ntfn x2 rv ret__unsigned rva xfdca rvb\<rbrace> asUser x2 (setRegister Notification_H.badgeRegister badge) \<lbrace>?Q3007 badgea ntfnPtr ntfn x2 rv ret__unsigned rva xfdca rvb xfdc\<rbrace>
 3. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned rva xfdc. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; option_to_ctcb_ptr (Some x2) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2965 badgea ntfnPtr ntfn x2 rv ret__unsigned rva\<rbrace> setThreadState Structures_H.thread_state.Running x2 \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3021 badgea ntfnPtr ntfn x2 rv ret__unsigned rva xfdc a\<rbrace>
 4. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; option_to_ctcb_ptr (Some x2) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv\<rbrakk> \<Longrightarrow> \<lbrace>?R2909 badge (ntfn_Ptr ntfnptr) ntfn x2 rv\<rbrace> cancelIPC x2 \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' x2 a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread x2 \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. x2 \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R2965 badgea ntfnPtr ntfn x2 rv ret__unsigned a\<rbrace>
 5. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf2888 badgea ntfnPtr ntfn x2 rv) (?Rf2884 badgea ntfnPtr ntfn x2 rv ret__unsigned) (SKIP # hs) (setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn) (CALL ntfn_set_active_'proc(ntfnPtr,badgea))
 6. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))) s \<in> {s. ntfnBoundTCB ntfn = None \<longrightarrow> s \<in> {s. badge_'_update (\<lambda>_. badgea) (ntfnPtr_'_update (\<lambda>_. ntfnPtr) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfnPtr\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace>} \<inter> - {}} \<inter> {s. \<forall>x. s \<in> {s. ntfnBoundTCB ntfn = Some x \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr x) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v v'. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift s (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))))} \<longrightarrow> s \<in> ({s. tptr_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s \<in> UNIV \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr x\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr x\<rbrace>} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> {s. w_'_update (\<lambda>_. badgea) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr x\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badgea\<rbrace>} \<inter> {s'. \<forall>tb rvb. dc rvb (xfdc tb) \<longrightarrow> s'\<lparr>globals := globals tb\<rparr> \<in> ?Q'3027 badgea ntfnPtr ntfn x ts v t rv ta rva tb rvb}}} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive\<rbrace> \<union> ?Rf2884 badgea ntfnPtr ntfn x ts v \<inter> - \<lbrace>v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive\<rbrace>) \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked ts\<rbrace>}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))}} \<inter> \<lbrace>tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) \<noteq> NULL\<rbrace>}}})
 7. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 8. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 9. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 10. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and ?R2909 badgea ntfnPtr ntfn x ts) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> ?Pf2888 badgea ntfnPtr ntfn x ts s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}
flex-flex pairs:
?Q'3027 badge (ntfn_Ptr ntfnptr) \<equiv>\<^sup>? \<lambda>ntfn x2 rv ret__unsigned t rva ta rvb tb rvc. ?Q'3026 ntfn x2 rv ret__unsigned rva (xfdc t) rvb (xfdc ta) rvc (xfdc tb) proof (prove)
goal (9 subgoals):
 1. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned rva xfdca rvb xfdc. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; option_to_ctcb_ptr (Some x2) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3021 badgea ntfnPtr ntfn x2 rv ret__unsigned rva xfdca rvb\<rbrace> asUser x2 (setRegister Notification_H.badgeRegister badge) \<lbrace>\<lambda>a. Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and st_tcb_at' runnable' x2 and (\<lambda>s. ksCurDomain s \<le> maxDomain) and valid_objs'\<rbrace>
 2. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned rva xfdc. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; option_to_ctcb_ptr (Some x2) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2965 badgea ntfnPtr ntfn x2 rv ret__unsigned rva\<rbrace> setThreadState Structures_H.thread_state.Running x2 \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3021 badgea ntfnPtr ntfn x2 rv ret__unsigned rva xfdc a\<rbrace>
 3. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; option_to_ctcb_ptr (Some x2) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv\<rbrakk> \<Longrightarrow> \<lbrace>?R2909 badge (ntfn_Ptr ntfnptr) ntfn x2 rv\<rbrace> cancelIPC x2 \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' x2 a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread x2 \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. x2 \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R2965 badgea ntfnPtr ntfn x2 rv ret__unsigned a\<rbrace>
 4. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf2888 badgea ntfnPtr ntfn x2 rv) (?Rf2884 badgea ntfnPtr ntfn x2 rv ret__unsigned) (SKIP # hs) (setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn) (CALL ntfn_set_active_'proc(ntfnPtr,badgea))
 5. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))) s \<in> {s. ntfnBoundTCB ntfn = None \<longrightarrow> s \<in> {s. badge_'_update (\<lambda>_. badgea) (ntfnPtr_'_update (\<lambda>_. ntfnPtr) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfnPtr\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace>} \<inter> - {}} \<inter> {s. \<forall>x. s \<in> {s. ntfnBoundTCB ntfn = Some x \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr x) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v v'. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift s (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))))} \<longrightarrow> s \<in> ({s. tptr_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s \<in> UNIV \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr x\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr x\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. w_'_update (\<lambda>_. badgea) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr x\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badgea\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s \<in> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr x\<rbrace> \<inter> UNIV}}}} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive\<rbrace> \<union> ?Rf2884 badgea ntfnPtr ntfn x ts v \<inter> - \<lbrace>v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive\<rbrace>) \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked ts\<rbrace>}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))}} \<inter> \<lbrace>tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) \<noteq> NULL\<rbrace>}}})
 6. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 7. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 8. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 9. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and ?R2909 badgea ntfnPtr ntfn x ts) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> ?Pf2888 badgea ntfnPtr ntfn x ts s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; tcb_ptr_to_ctcb_ptr x2 \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv\<rbrakk> \<Longrightarrow> \<lbrace>?P'3144 badge (ntfn_Ptr ntfnptr) ntfn x2 rv\<rbrace> cancelIPC x2 \<lbrace>\<lambda>rv s. valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> tcb_at' x2 s \<and> ksCurDomain s \<le> maxDomain \<and> valid_objs' s\<rbrace>
 2. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf2888 badgea ntfnPtr ntfn x2 rv) (?Rf2884 badgea ntfnPtr ntfn x2 rv ret__unsigned) (SKIP # hs) (setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn) (CALL ntfn_set_active_'proc(ntfnPtr,badgea))
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))) s \<in> {s. ntfnBoundTCB ntfn = None \<longrightarrow> s \<in> {s. badge_'_update (\<lambda>_. badgea) (ntfnPtr_'_update (\<lambda>_. ntfnPtr) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfnPtr\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace>} \<inter> - {}} \<inter> {s. \<forall>x. s \<in> {s. ntfnBoundTCB ntfn = Some x \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr x) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v v'. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift s (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))))} \<longrightarrow> s \<in> ({s. tptr_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s \<in> UNIV \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr x\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr x\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. w_'_update (\<lambda>_. badgea) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr x\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badgea\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s \<in> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr x\<rbrace> \<inter> UNIV}}}} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive\<rbrace> \<union> ?Rf2884 badgea ntfnPtr ntfn x ts v \<inter> - \<lbrace>v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive\<rbrace>) \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked ts\<rbrace>}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))}} \<inter> \<lbrace>tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) \<noteq> NULL\<rbrace>}}})
 4. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 5. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 6. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 7. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> ?P'3144 badgea ntfnPtr ntfn x ts a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> ?Pf2888 badgea ntfnPtr ntfn x ts s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned rva s. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; tcb_ptr_to_ctcb_ptr x2 \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv; (tcb_at' (the (ntfnBoundTCB ntfn)) and invs') s\<rbrakk> \<Longrightarrow> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> tcb_at' x2 s \<and> ksCurDomain s \<le> maxDomain \<and> valid_objs' s
 2. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; tcb_ptr_to_ctcb_ptr x2 \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv\<rbrakk> \<Longrightarrow> \<lbrace>?P'3144 badge (ntfn_Ptr ntfnptr) ntfn x2 rv\<rbrace> cancelIPC x2 \<lbrace>\<lambda>_. tcb_at' (the (ntfnBoundTCB ntfn)) and invs'\<rbrace>
 3. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf2888 badgea ntfnPtr ntfn x2 rv) (?Rf2884 badgea ntfnPtr ntfn x2 rv ret__unsigned) (SKIP # hs) (setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn) (CALL ntfn_set_active_'proc(ntfnPtr,badgea))
 4. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))) s \<in> {s. ntfnBoundTCB ntfn = None \<longrightarrow> s \<in> {s. badge_'_update (\<lambda>_. badgea) (ntfnPtr_'_update (\<lambda>_. ntfnPtr) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfnPtr\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace>} \<inter> - {}} \<inter> {s. \<forall>x. s \<in> {s. ntfnBoundTCB ntfn = Some x \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr x) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v v'. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift s (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))))} \<longrightarrow> s \<in> ({s. tptr_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s \<in> UNIV \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr x\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr x\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. w_'_update (\<lambda>_. badgea) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr x\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badgea\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s \<in> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr x\<rbrace> \<inter> UNIV}}}} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive\<rbrace> \<union> ?Rf2884 badgea ntfnPtr ntfn x ts v \<inter> - \<lbrace>v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive\<rbrace>) \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked ts\<rbrace>}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))}} \<inter> \<lbrace>tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) \<noteq> NULL\<rbrace>}}})
 5. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 6. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 7. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 8. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> ?P'3144 badgea ntfnPtr ntfn x ts a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> ?Pf2888 badgea ntfnPtr ntfn x ts s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; tcb_ptr_to_ctcb_ptr x2 \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv\<rbrakk> \<Longrightarrow> \<lbrace>?P'3144 badge (ntfn_Ptr ntfnptr) ntfn x2 rv\<rbrace> cancelIPC x2 \<lbrace>\<lambda>_. tcb_at' (the (ntfnBoundTCB ntfn)) and invs'\<rbrace>
 2. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf2888 badgea ntfnPtr ntfn x2 rv) (?Rf2884 badgea ntfnPtr ntfn x2 rv ret__unsigned) (SKIP # hs) (setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn) (CALL ntfn_set_active_'proc(ntfnPtr,badgea))
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))) s \<in> {s. ntfnBoundTCB ntfn = None \<longrightarrow> s \<in> {s. badge_'_update (\<lambda>_. badgea) (ntfnPtr_'_update (\<lambda>_. ntfnPtr) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfnPtr\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace>} \<inter> - {}} \<inter> {s. \<forall>x. s \<in> {s. ntfnBoundTCB ntfn = Some x \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr x) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v v'. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift s (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))))} \<longrightarrow> s \<in> ({s. tptr_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s \<in> UNIV \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr x\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr x\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. w_'_update (\<lambda>_. badgea) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr x\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badgea\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s \<in> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr x\<rbrace> \<inter> UNIV}}}} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive\<rbrace> \<union> ?Rf2884 badgea ntfnPtr ntfn x ts v \<inter> - \<lbrace>v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive\<rbrace>) \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked ts\<rbrace>}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))}} \<inter> \<lbrace>tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) \<noteq> NULL\<rbrace>}}})
 4. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 5. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 6. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 7. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> ?P'3144 badgea ntfnPtr ntfn x ts a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> ?Pf2888 badgea ntfnPtr ntfn x ts s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf2888 badgea ntfnPtr ntfn x2 rv) (?Rf2884 badgea ntfnPtr ntfn x2 rv ret__unsigned) (SKIP # hs) (setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn) (CALL ntfn_set_active_'proc(ntfnPtr,badgea))
 2. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))) s \<in> {s. ntfnBoundTCB ntfn = None \<longrightarrow> s \<in> {s. badge_'_update (\<lambda>_. badgea) (ntfnPtr_'_update (\<lambda>_. ntfnPtr) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfnPtr\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace>} \<inter> - {}} \<inter> {s. \<forall>x. s \<in> {s. ntfnBoundTCB ntfn = Some x \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr x) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v v'. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift s (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))))} \<longrightarrow> s \<in> ({s. tptr_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s \<in> UNIV \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr x\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr x\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. w_'_update (\<lambda>_. badgea) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr x\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badgea\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s \<in> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr x\<rbrace> \<inter> UNIV}}}} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive\<rbrace> \<union> ?Rf2884 badgea ntfnPtr ntfn x ts v \<inter> - \<lbrace>v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive\<rbrace>) \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked ts\<rbrace>}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))}} \<inter> \<lbrace>tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) \<noteq> NULL\<rbrace>}}})
 3. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 4. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 5. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 6. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> ?Pf2888 badgea ntfnPtr ntfn x ts s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>badgea ntfnPtr ntfn x2 rv ret__unsigned. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; option_to_ctcb_ptr (Some x2) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some x2; (ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf2888 badge (ntfn_Ptr ntfnptr) ntfn x2 rv) (?Rf2884 badge (ntfn_Ptr ntfnptr) ntfn x2 rv ret__unsigned) (SKIP # hs) (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn badge) ntfn)) (CALL ntfn_set_active_'proc(ntfn_Ptr ntfnptr,badge))
 2. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))) s \<in> {s. ntfnBoundTCB ntfn = None \<longrightarrow> s \<in> {s. badge_'_update (\<lambda>_. badgea) (ntfnPtr_'_update (\<lambda>_. ntfnPtr) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfnPtr\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace>} \<inter> - {}} \<inter> {s. \<forall>x. s \<in> {s. ntfnBoundTCB ntfn = Some x \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr x) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v v'. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift s (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))))} \<longrightarrow> s \<in> ({s. tptr_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s \<in> UNIV \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr x\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr x\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. w_'_update (\<lambda>_. badgea) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr x\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badgea\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s \<in> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr x\<rbrace> \<inter> UNIV}}}} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive\<rbrace> \<union> ?Rf2884 badgea ntfnPtr ntfn x ts v \<inter> - \<lbrace>v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive\<rbrace>) \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked ts\<rbrace>}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))}} \<inter> \<lbrace>tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) \<noteq> NULL\<rbrace>}}})
 3. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 4. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 5. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 6. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> ?Pf2888 badgea ntfnPtr ntfn x ts s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) ret__unsigned_' (\<lambda>rv rv'. {s. tcb_'_update (\<lambda>_. tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))) s \<in> {s. ntfnBoundTCB ntfn = None \<longrightarrow> s \<in> {s. badge_'_update (\<lambda>_. badgea) (ntfnPtr_'_update (\<lambda>_. ntfnPtr) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfnPtr\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace>} \<inter> - {}} \<inter> {s. \<forall>x. s \<in> {s. ntfnBoundTCB ntfn = Some x \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr x) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v v'. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = tsType_CL (thread_state_lift (tcbState_C (the (cslift s (option_to_ctcb_ptr (ntfnBoundTCB ntfn))))))} \<longrightarrow> s \<in> ({s. tptr_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s \<in> UNIV \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr x\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr x\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. w_'_update (\<lambda>_. badgea) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr x\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badgea\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. option_to_ctcb_ptr (Some x)) s \<in> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr x\<rbrace> \<inter> UNIV}}}} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive\<rbrace> \<union> {s. badge_'_update (\<lambda>_. badgea) (ntfnPtr_'_update (\<lambda>_. ntfnPtr) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfnPtr\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace>} \<inter> - \<lbrace>v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive\<rbrace>) \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive) = receiveBlocked ts\<rbrace>}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)))}} \<inter> \<lbrace>tcb_Ptr (ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))) \<noteq> NULL\<rbrace>}}})
 2. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 3. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 4. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 5. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>ntfn s x ts tcb'. \<lbrakk>tcb_ptr_to_ctcb_ptr x \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ret__unsigned_' s = ptr_val (tcb_ptr_to_ctcb_ptr x); ntfnBoundTCB ntfn = Some x; cslift s (tcb_ptr_to_ctcb_ptr x) = Some tcb'; cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb')\<rbrakk> \<Longrightarrow> (tsType_CL (thread_state_lift (tcbState_C tcb')) = 3) = receiveBlocked ts \<and> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x
 2. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 3. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 4. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 5. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>badgea ntfnPtr ntfn x2. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn x2) (?R''2324 badgea ntfnPtr ntfn x2) (SKIP # hs) (do newBadge <- return (badge || x2);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 2. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 4. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>badgea ntfnPtr ntfn old_badge. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn old_badge) (?R''2324 badgea ntfnPtr ntfn old_badge) (SKIP # hs) (do newBadge <- return (badge || old_badge);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 2. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2324 badgea ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 4. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>badgea ntfnPtr ntfn old_badge. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn old_badge) (?R'3222 badgea ntfnPtr ntfn old_badge) (SKIP # hs) (do newBadge <- return (badge || old_badge);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI)
 2. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R'3222 badgea ntfnPtr ntfn x \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 4. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>badgea ntfnPtr ntfn old_badge. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn old_badge) (?R'3224 badgea ntfnPtr ntfn old_badge) (SKIP # hs) (do newBadge <- return (badge || old_badge);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI)
 2. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R'3224 badgea ntfnPtr ntfn x \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 4. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>badgea ntfnPtr ntfn old_badge. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badgea ntfnPtr ntfn old_badge) (?R'3226 badgea ntfnPtr ntfn old_badge) (SKIP # hs) (do newBadge <- return (badge || old_badge);
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) ntfn
od) (lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2))
 2. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R'3226 badgea ntfnPtr ntfn x \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 4. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>ntfn old_badge. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2321 badge (ntfn_Ptr ntfnptr) ntfn old_badge) (?R'3226 badge (ntfn_Ptr ntfnptr) ntfn old_badge) (SKIP # hs) (setObject ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn (badge || old_badge)) ntfn)) (lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badge;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr,\<acute>badge2))
 2. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R'3226 badgea ntfnPtr ntfn x \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 4. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2321 badgea ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>ntfn old_badge. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (invs' and ko_at' ntfn ntfnptr) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badge;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr,\<acute>badge2) {s. \<exists>(rv, \<sigma>')\<in>fst (setObject ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn (badge || old_badge)) ntfn) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)}
 2. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 4. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>ntfn old_badge \<sigma>. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. (invs' and ko_at' ntfn ntfnptr) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badge;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr,\<acute>badge2) {s. \<exists>(rv, \<sigma>')\<in>fst (setObject ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn (badge || old_badge)) ntfn) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)}
 2. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 4. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>ntfn old_badge \<sigma>. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge\<rbrakk> \<Longrightarrow> {s. (invs' and ko_at' ntfn ntfnptr) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>v. s \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>t. ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift (the (cslift s (ntfn_Ptr ntfnptr)))) \<longrightarrow> s \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift (the (cslift s (ntfn_Ptr ntfnptr)))\<lparr>ntfnMsgIdentifier_CL := (ntfnMsgIdentifier_CL (notification_lift (the (cslift s (ntfn_Ptr ntfnptr)))) || badge) && mask 32\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals s))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (setObject ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn (badge || old_badge)) ntfn) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_' := ntfnMsgIdentifier_CL (notification_lift (the (cslift s (ntfn_Ptr ntfnptr)))), badge2_' := ntfnMsgIdentifier_CL (notification_lift (the (cslift s (ntfn_Ptr ntfnptr)))) || badge, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr \<and> dc rv (xfdc (s\<lparr>ret__unsigned_' := ntfnMsgIdentifier_CL (notification_lift (the (cslift s (ntfn_Ptr ntfnptr)))), badge2_' := ntfnMsgIdentifier_CL (notification_lift (the (cslift s (ntfn_Ptr ntfnptr)))) || badge, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)))))}
 2. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 4. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>ntfn old_badge \<sigma> x. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> ((\<exists>t. ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) || badge\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))) \<longrightarrow> (\<exists>xa\<in>fst (setObject ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn (badge || old_badge)) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := ntfnMsgIdentifier_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))), badge2_' := ntfnMsgIdentifier_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) || badge, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr)))
 2. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 4. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>ntfn old_badge \<sigma> x. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; \<exists>ko'. cslift x (ntfn_Ptr ntfnptr) = Some ko' \<and> cnotification_relation (cslift x) ntfn ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> ((\<exists>t. ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) || badge\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))) \<longrightarrow> (\<exists>xa\<in>fst (setObject ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn (badge || old_badge)) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := ntfnMsgIdentifier_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))), badge2_' := ntfnMsgIdentifier_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) || badge, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr)))
 2. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 4. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>ntfn old_badge \<sigma> x ko' t ta notification. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setObject ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn (badge || old_badge)) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := ntfnMsgIdentifier_CL (notification_lift ko'), badge2_' := ntfnMsgIdentifier_CL (notification_lift ko') || badge, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 4. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>ntfn old_badge \<sigma> x ko' t ta notification. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> case ((), \<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> injectKOS (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn (badge || old_badge)) ntfn))\<rparr>) of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ret__unsigned_' := ntfnMsgIdentifier_CL (notification_lift ko'), badge2_' := ntfnMsgIdentifier_CL (notification_lift ko') || badge, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>ntfn old_badge \<sigma> x ko' t ta notification val old ptr ptr' next. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>ntfn old_badge \<sigma> x ko' t ta notification v. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>ntfn old_badge \<sigma> x ko' t ta notification v v'. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>ntfn old_badge \<sigma> x ko' t ta notification. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P3307 ntfn old_badge \<sigma> x ko' t ta notification) ntfnptr \<sigma>
 6. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 7. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 8. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>ntfn old_badge \<sigma> x ko' t ta notification. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)) \<and> cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation \<and> cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr \<and> carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>) \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>) \<and> ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<and> ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>) \<and> cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState \<sigma>) (globals x) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x) \<and> cte_array_relation \<sigma> (globals x) \<and> tcb_cte_array_relation \<sigma> (globals x) \<and> apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>) \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>) \<and> ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma> \<and> x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr \<and> {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs \<and> x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr \<and> {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs \<and> htd_safe domain (hrs_htd (t_hrs_' (globals x))) \<and> - domain \<subseteq> kernel_data_refs \<and> globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list \<and> cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule \<and> ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>) \<and> ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>) \<and> ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn (badge || old_badge)) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> notification)) ntfn_Ptr (cnotification_relation (cslift x)) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>)
 2. \<And>ntfn old_badge \<sigma> x ko' t ta notification val old ptr ptr' next. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>ntfn old_badge \<sigma> x ko' t ta notification v. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>ntfn old_badge \<sigma> x ko' t ta notification v v'. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>ntfn old_badge \<sigma> x ko' t ta notification. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P3307 ntfn old_badge \<sigma> x ko' t ta notification) ntfnptr \<sigma>
 6. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 7. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 8. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>ntfn old_badge \<sigma> x ko' t ta notification. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn (badge || old_badge)) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> notification)) ntfn_Ptr (cnotification_relation (cslift x)) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>)
 2. \<And>ntfn old_badge \<sigma> x ko' t ta notification val old ptr ptr' next. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>ntfn old_badge \<sigma> x ko' t ta notification v. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>ntfn old_badge \<sigma> x ko' t ta notification v v'. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>ntfn old_badge \<sigma> x ko' t ta notification. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P3307 ntfn old_badge \<sigma> x ko' t ta notification) ntfnptr \<sigma>
 6. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 7. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 8. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>ntfn old_badge \<sigma> x ko' t ta notification. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn (badge || old_badge)) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> notification)) ntfn_Ptr (cnotification_relation (cslift x))
 2. \<And>ntfn old_badge \<sigma> x ko' t ta notification. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>)
 3. \<And>ntfn old_badge \<sigma> x ko' t ta notification. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>)
 4. \<And>ntfn old_badge \<sigma> x ko' t ta notification val old ptr ptr' next. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>ntfn old_badge \<sigma> x ko' t ta notification v. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>ntfn old_badge \<sigma> x ko' t ta notification v v'. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>ntfn old_badge \<sigma> x ko' t ta notification. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P3307 ntfn old_badge \<sigma> x ko' t ta notification) ntfnptr \<sigma>
 8. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 9. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 10. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (11 subgoals):
 1. \<And>ntfn old_badge \<sigma> x ko' t ta notification. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cnotification_relation (cslift x) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn (badge || old_badge)) ntfn) notification
 2. \<And>ntfn old_badge \<sigma> x ko' t ta notification. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn) then set (ntfnQueue (ntfnObj ntfn)) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn) then set (ntfnQueue (ntfnObj ntfn)) else {}))\<^esub>
 3. \<And>ntfn old_badge \<sigma> x ko' t ta notification. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>)
 4. \<And>ntfn old_badge \<sigma> x ko' t ta notification. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>)
 5. \<And>ntfn old_badge \<sigma> x ko' t ta notification val old ptr ptr' next. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>ntfn old_badge \<sigma> x ko' t ta notification v. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>ntfn old_badge \<sigma> x ko' t ta notification v v'. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>ntfn old_badge \<sigma> x ko' t ta notification. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P3307 ntfn old_badge \<sigma> x ko' t ta notification) ntfnptr \<sigma>
 9. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 10. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>ntfn old_badge \<sigma> x ko' t ta notification. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn) then set (ntfnQueue (ntfnObj ntfn)) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn) then set (ntfnQueue (ntfnObj ntfn)) else {}))\<^esub>
 2. \<And>ntfn old_badge \<sigma> x ko' t ta notification. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>)
 3. \<And>ntfn old_badge \<sigma> x ko' t ta notification. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>)
 4. \<And>ntfn old_badge \<sigma> x ko' t ta notification val old ptr ptr' next. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>ntfn old_badge \<sigma> x ko' t ta notification v. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>ntfn old_badge \<sigma> x ko' t ta notification v v'. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>ntfn old_badge \<sigma> x ko' t ta notification. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P3307 ntfn old_badge \<sigma> x ko' t ta notification) ntfnptr \<sigma>
 8. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 9. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 10. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>ntfn old_badge \<sigma> x ko' t ta notification. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>)
 2. \<And>ntfn old_badge \<sigma> x ko' t ta notification. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>)
 3. \<And>ntfn old_badge \<sigma> x ko' t ta notification val old ptr ptr' next. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 4. \<And>ntfn old_badge \<sigma> x ko' t ta notification v. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 5. \<And>ntfn old_badge \<sigma> x ko' t ta notification v v'. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 6. \<And>ntfn old_badge \<sigma> x ko' t ta notification. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P3307 ntfn old_badge \<sigma> x ko' t ta notification) ntfnptr \<sigma>
 7. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 8. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 9. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>ntfn old_badge \<sigma> x ko' t ta notification. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>)
 2. \<And>ntfn old_badge \<sigma> x ko' t ta notification val old ptr ptr' next. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>ntfn old_badge \<sigma> x ko' t ta notification v. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>ntfn old_badge \<sigma> x ko' t ta notification v v'. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>ntfn old_badge \<sigma> x ko' t ta notification. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P3307 ntfn old_badge \<sigma> x ko' t ta notification) ntfnptr \<sigma>
 6. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 7. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 8. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>ntfn old_badge \<sigma> x ko' t ta notification val old ptr ptr' next. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 2. \<And>ntfn old_badge \<sigma> x ko' t ta notification v. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 3. \<And>ntfn old_badge \<sigma> x ko' t ta notification v v'. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 4. \<And>ntfn old_badge \<sigma> x ko' t ta notification. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P3307 ntfn old_badge \<sigma> x ko' t ta notification) ntfnptr \<sigma>
 5. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 6. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 7. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>ntfn old_badge \<sigma> x ko' t ta notification v. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 2. \<And>ntfn old_badge \<sigma> x ko' t ta notification v v'. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 3. \<And>ntfn old_badge \<sigma> x ko' t ta notification. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P3307 ntfn old_badge \<sigma> x ko' t ta notification) ntfnptr \<sigma>
 4. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 5. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 6. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>ntfn old_badge \<sigma> x ko' t ta notification v v'. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 2. \<And>ntfn old_badge \<sigma> x ko' t ta notification. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P3307 ntfn old_badge \<sigma> x ko' t ta notification) ntfnptr \<sigma>
 3. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 4. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 5. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>ntfn old_badge \<sigma> x ko' t ta notification. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn old_badge; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; ret__unsigned_' t = ntfnMsgIdentifier_CL (notification_lift ko'); notification_lift notification = notification_lift ko'\<lparr>ntfnMsgIdentifier_CL := ntfnMsgIdentifier_CL (notification_lift ko') || badge\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P3307 ntfn old_badge \<sigma> x ko' t ta notification) ntfnptr \<sigma>
 2. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 4. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R''2325 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfnPtr);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>tcb \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_tsType_'proc(PTR(thread_state_C) &(\<acute>tcb\<rightarrow>[''tcbState_C''])));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive THEN
  CALL cancelIPC_'proc(\<acute>tcb);;
CALL setThreadState_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>tcb)
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  CALL ntfn_set_active_'proc(ntfnPtr,badgea)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI
FI)
 2. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2325 badgea ntfnPtr ntfn x}}))
 3. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R'3358 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  lvar_nondet_init badge2_' badge2_'_update;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge2 :== \<acute>ret__unsigned;;
\<acute>badge2 :== \<acute>badge2 || badgea;;
CALL notification_ptr_set_ntfnMsgIdentifier_'proc(ntfnPtr,UCAST(32 \<rightarrow> 32) \<acute>badge2)
FI
FI)
 2. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R'3358 badgea ntfnPtr ntfn x \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 3. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2322 badgea ntfnPtr ntfn x3) (?R'3360 badgea ntfnPtr ntfn x3) (SKIP # hs) (case x3 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest))
 2. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R'3360 badgea ntfnPtr ntfn x \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 3. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2322 badgea ntfnPtr ntfn x s)) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = []\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3371 badgea ntfnPtr ntfn x3) (?R''3373 badgea ntfnPtr ntfn x3) (SKIP # hs) (haskell_fail []) (lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest))
 2. \<And>badgea ntfnPtr ntfn x3 x21 x22. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = x21 # x22\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3372 badgea ntfnPtr ntfn x3 x21 x22) (?R''3374 badgea ntfnPtr ntfn x3 x21 x22) (SKIP # hs) (do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case x22 of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn x22) ntfn;
setThreadState Structures_H.thread_state.Running x21;
asUser x21 $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo x21
od) (lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest))
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. x = [] \<longrightarrow> s \<in> ?R''3373 badgea ntfnPtr ntfn x} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> ?R''3374 badgea ntfnPtr ntfn x xa xb}}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 4. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (x = [] \<longrightarrow> ?R3371 badgea ntfnPtr ntfn x s) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> ?R3372 badgea ntfnPtr ntfn x xa xb s))) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>badgea ntfnPtr ntfn x3. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn []; x3 = []\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3371 badge (ntfn_Ptr ntfnptr) ntfn []) (?R''3373 badge (ntfn_Ptr ntfnptr) ntfn []) (SKIP # hs) fail (lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr ntfnptr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr ntfnptr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge);;
CALL possibleSwitchTo_'proc(\<acute>dest))
 2. \<And>badgea ntfnPtr ntfn x3 x21 x22. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = x21 # x22\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3372 badgea ntfnPtr ntfn x3 x21 x22) (?R''3374 badgea ntfnPtr ntfn x3 x21 x22) (SKIP # hs) (do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case x22 of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn x22) ntfn;
setThreadState Structures_H.thread_state.Running x21;
asUser x21 $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo x21
od) (lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest))
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. x = [] \<longrightarrow> s \<in> ?R''3373 badgea ntfnPtr ntfn x} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> ?R''3374 badgea ntfnPtr ntfn x xa xb}}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 4. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (x = [] \<longrightarrow> ?R3371 badgea ntfnPtr ntfn x s) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> ?R3372 badgea ntfnPtr ntfn x xa xb s))) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>badgea ntfnPtr ntfn x3 x21 x22. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = x21 # x22\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3372 badgea ntfnPtr ntfn x3 x21 x22) (?R''3374 badgea ntfnPtr ntfn x3 x21 x22) (SKIP # hs) (do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case x22 of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn x22) ntfn;
setThreadState Structures_H.thread_state.Running x21;
asUser x21 $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo x21
od) (lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest))
 2. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> ?R''3374 badgea ntfnPtr ntfn x xa xb}}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 3. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> ?R3372 badgea ntfnPtr ntfn x xa xb s))) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3372 badgea ntfnPtr ntfn x3 dest rest) (?R''3374 badgea ntfnPtr ntfn x3 dest rest) (SKIP # hs) (do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest))
 2. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> ?R''3374 badgea ntfnPtr ntfn x xa xb}}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 3. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> ?R3372 badgea ntfnPtr ntfn x xa xb s))) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3372 badgea ntfnPtr ntfn x3 dest rest) (?R''3374 badgea ntfnPtr ntfn x3 dest rest) (SKIP # hs) (do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
(lvar_nondet_init dest_' dest_'_update;;
(\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
(\<acute>dest :== head_C \<acute>ntfn_queue;;
(\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
(CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
(IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
(CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest))))))))))
 2. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> ?R''3374 badgea ntfnPtr ntfn x xa xb}}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 3. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> ?R3372 badgea ntfnPtr ntfn x xa xb s))) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3372 badgea ntfnPtr ntfn x3 dest rest) (?G'3398 badgea ntfnPtr ntfn x3 dest rest) (SKIP # hs) (do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
(\<acute>dest :== head_C \<acute>ntfn_queue;;
(\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
(CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
(IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
(CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest))))))))
 2. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> ?G'3398 badgea ntfnPtr ntfn x xa xb}}}}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 3. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> ?R3372 badgea ntfnPtr ntfn x xa xb s))) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3372 badgea ntfnPtr ntfn x3 dest rest) (?G'3398 badgea ntfnPtr ntfn x3 dest rest) (SKIP # hs) (do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest))
 2. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> ?G'3398 badgea ntfnPtr ntfn x xa xb}}}}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 3. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> ?R3372 badgea ntfnPtr ntfn x xa xb s))) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3372 badgea ntfnPtr ntfn x3 dest rest) (?G'3398 badgea ntfnPtr ntfn x3 dest rest) (SKIP # hs) (do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest)))
 2. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> ?G'3398 badgea ntfnPtr ntfn x xa xb}}}}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 3. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> ?R3372 badgea ntfnPtr ntfn x xa xb s))) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3372 badgea ntfnPtr ntfn x3 dest rest) (?G'3398 badgea ntfnPtr ntfn x3 dest rest) (SKIP # hs) (do setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) ntfn;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI;;
(CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest))))
 2. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> ?G'3398 badgea ntfnPtr ntfn x xa xb}}}}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 3. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> ?R3372 badgea ntfnPtr ntfn x xa xb s))) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> ccorres (?r'3417 badgea ntfnPtr ntfn x3 dest rest) (?xf'3417 badgea ntfnPtr ntfn x3 dest rest) (?P3417 badgea ntfnPtr ntfn x3 dest rest) (?G'3398 badgea ntfnPtr ntfn x3 dest rest) [] (setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) ntfn) (\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfnPtr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfnPtr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI)
 2. \<And>badgea ntfnPtr ntfn x3 dest rest rv' t t'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'3417 badgea ntfnPtr ntfn x3 dest rest) rv' t t' (CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest))) (?d'3417 badgea ntfnPtr ntfn x3 dest rest rv')
 3. \<And>badgea ntfnPtr ntfn x3 dest rest rv rv'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest; ?r'3417 badgea ntfnPtr ntfn x3 dest rest rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3417 badgea ntfnPtr ntfn x3 dest rest rv) (?Q'3417 badgea ntfnPtr ntfn x3 dest rest rv rv') (SKIP # hs) (K_bind (do setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) rv) (?d'3417 badgea ntfnPtr ntfn x3 dest rest rv')
 4. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R3417 badgea ntfnPtr ntfn x3 dest rest\<rbrace> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) ntfn \<lbrace>?Q3417 badgea ntfnPtr ntfn x3 dest rest\<rbrace>
 5. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'3417 badgea ntfnPtr ntfn x3 dest rest) (?xf'3417 badgea ntfnPtr ntfn x3 dest rest) (?Q'3417 badgea ntfnPtr ntfn x3 dest rest)
 6. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> ?G'3398 badgea ntfnPtr ntfn x xa xb}}}}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 7. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (?P3417 badgea ntfnPtr ntfn x xa xb and ?R3417 badgea ntfnPtr ntfn x xa xb) s))) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn (dest # rest); x3 = dest # rest\<rbrakk> \<Longrightarrow> ccorres (?r'3417 badge (ntfn_Ptr ntfnptr) ntfn (dest # rest) dest rest) (?xf'3417 badge (ntfn_Ptr ntfnptr) ntfn (dest # rest) dest rest) (?P3417 badge (ntfn_Ptr ntfnptr) ntfn (dest # rest) dest rest) (?G'3398 badge (ntfn_Ptr ntfnptr) ntfn (dest # rest) dest rest) [] (setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) ntfn) (\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr ntfnptr);;
\<acute>dest :== head_C \<acute>ntfn_queue;;
\<acute>ntfn_queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>ntfn_queue);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr ntfnptr,\<acute>ntfn_queue);;
IF head_C \<acute>ntfn_queue = NULL THEN
  CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI)
 2. \<And>badgea ntfnPtr ntfn x3 dest rest rv' t t'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'3417 badgea ntfnPtr ntfn x3 dest rest) rv' t t' (CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest))) (?d'3417 badgea ntfnPtr ntfn x3 dest rest rv')
 3. \<And>badgea ntfnPtr ntfn x3 dest rest rv rv'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest; ?r'3417 badgea ntfnPtr ntfn x3 dest rest rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3417 badgea ntfnPtr ntfn x3 dest rest rv) (?Q'3417 badgea ntfnPtr ntfn x3 dest rest rv rv') (SKIP # hs) (K_bind (do setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) rv) (?d'3417 badgea ntfnPtr ntfn x3 dest rest rv')
 4. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R3417 badgea ntfnPtr ntfn x3 dest rest\<rbrace> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) ntfn \<lbrace>?Q3417 badgea ntfnPtr ntfn x3 dest rest\<rbrace>
 5. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'3417 badgea ntfnPtr ntfn x3 dest rest) (?xf'3417 badgea ntfnPtr ntfn x3 dest rest) (?Q'3417 badgea ntfnPtr ntfn x3 dest rest)
 6. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> ?G'3398 badgea ntfnPtr ntfn x xa xb}}}}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 7. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (?P3417 badgea ntfnPtr ntfn x xa xb and ?R3417 badgea ntfnPtr ntfn x xa xb) s))) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>badgea ntfnPtr ntfn x3 dest rest rv' t t'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> ceqv \<Gamma> dest_' rv' t t' (CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL setRegister_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(\<acute>dest))) (?d'3417 badgea ntfnPtr ntfn x3 dest rest rv')
 2. \<And>badgea ntfnPtr ntfn x3 dest rest rv rv'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest; rv' = tcb_ptr_to_ctcb_ptr dest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3417 badgea ntfnPtr ntfn x3 dest rest rv) (?Q'3417 badgea ntfnPtr ntfn x3 dest rest rv rv') (SKIP # hs) (K_bind (do setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) rv) (?d'3417 badgea ntfnPtr ntfn x3 dest rest rv')
 3. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R3417 badgea ntfnPtr ntfn x3 dest rest\<rbrace> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) ntfn \<lbrace>?Q3417 badgea ntfnPtr ntfn x3 dest rest\<rbrace>
 4. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = tcb_ptr_to_ctcb_ptr dest) dest_' (?Q'3417 badgea ntfnPtr ntfn x3 dest rest)
 5. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> UNIV}}}}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 6. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfnptr)) xa and ko_at' ntfn ntfnptr and K (ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x) and ?R3417 badgea ntfnPtr ntfn x xa xb) s))) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>badgea ntfnPtr ntfn x3 dest rest rv rv'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest; rv' = tcb_ptr_to_ctcb_ptr dest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3417 badgea ntfnPtr ntfn x3 dest rest rv) (?Q'3417 badgea ntfnPtr ntfn x3 dest rest rv rv') (SKIP # hs) (K_bind (do setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) rv) (CALL setThreadState_'proc(rv',SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL setRegister_'proc(rv',SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea);;
CALL possibleSwitchTo_'proc(rv')))
 2. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R3417 badgea ntfnPtr ntfn x3 dest rest\<rbrace> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) ntfn \<lbrace>?Q3417 badgea ntfnPtr ntfn x3 dest rest\<rbrace>
 3. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = tcb_ptr_to_ctcb_ptr dest) dest_' (?Q'3417 badgea ntfnPtr ntfn x3 dest rest)
 4. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> UNIV}}}}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 5. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfnptr)) xa and ko_at' ntfn ntfnptr and K (ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x) and ?R3417 badgea ntfnPtr ntfn x xa xb) s))) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>badgea ntfnPtr ntfn x3 dest rest rv rv'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn (dest # rest); x3 = dest # rest; rv' = tcb_ptr_to_ctcb_ptr dest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3417 badge (ntfn_Ptr ntfnptr) ntfn (dest # rest) dest rest rv) (?Q'3417 badge (ntfn_Ptr ntfnptr) ntfn (dest # rest) dest rest rv (tcb_ptr_to_ctcb_ptr dest)) (SKIP # hs) (do y <- setThreadState Structures_H.thread_state.Running dest;
y <- asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr dest)))
 2. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R3417 badgea ntfnPtr ntfn x3 dest rest\<rbrace> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) ntfn \<lbrace>?Q3417 badgea ntfnPtr ntfn x3 dest rest\<rbrace>
 3. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = tcb_ptr_to_ctcb_ptr dest) dest_' (?Q'3417 badgea ntfnPtr ntfn x3 dest rest)
 4. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> UNIV}}}}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 5. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfnptr)) xa and ko_at' ntfn ntfnptr and K (ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x) and ?R3417 badgea ntfnPtr ntfn x xa xb) s))) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>badgea ntfnPtr ntfn x3 dest rest rv rv' rva xfdca. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn (dest # rest); x3 = dest # rest; rv' = tcb_ptr_to_ctcb_ptr dest; dc rva xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3504 badgea ntfnPtr ntfn x3 dest rest rv rv' rva) (?Q'3521 ntfn dest rest rv rva xfdca) (SKIP # hs) (do y <- asUser dest $ setRegister Notification_H.badgeRegister badge;
possibleSwitchTo dest
od) (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr dest))
 2. \<And>badgea ntfnPtr ntfn x3 dest rest rv rv'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn (dest # rest); x3 = dest # rest; rv' = tcb_ptr_to_ctcb_ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R3515 badge (ntfn_Ptr ntfnptr) ntfn (dest # rest) dest rest rv\<rbrace> setThreadState Structures_H.thread_state.Running dest \<lbrace>?Q3504 badgea ntfnPtr ntfn x3 dest rest rv rv'\<rbrace>
 3. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R3417 badgea ntfnPtr ntfn x3 dest rest\<rbrace> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) ntfn \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' dest a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread dest \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. dest \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R3515 badgea ntfnPtr ntfn x3 dest rest a\<rbrace>
 4. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. b) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = b\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'3520 badgea ntfnPtr ntfn x3 dest rest a b t rv})
 5. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> UNIV}}}}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 6. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfnptr)) xa and ko_at' ntfn ntfnptr and K (ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x) and ?R3417 badgea ntfnPtr ntfn x xa xb) s))) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}
flex-flex pairs:
\<lambda>ntfn dest rest rv t rva. ?Q'3521 ntfn dest rest rv rva (xfdc t) \<equiv>\<^sup>? \<lambda>ntfn dest rest rv. ?Q'3520 badge (ntfn_Ptr ntfnptr) ntfn (dest # rest) dest rest rv (tcb_ptr_to_ctcb_ptr dest) proof (prove)
goal (6 subgoals):
 1. \<And>badgea ntfnPtr ntfn x3 dest rest rv' xfdca. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn (dest # rest); x3 = dest # rest; rv' = tcb_ptr_to_ctcb_ptr dest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3504 badge (ntfn_Ptr ntfnptr) ntfn (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) ()) (?Q'3521 ntfn dest rest () () xfdca) (SKIP # hs) (do y <- asUser dest (setRegister Notification_H.badgeRegister badge);
possibleSwitchTo dest
od) (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dest,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr dest))
 2. \<And>badgea ntfnPtr ntfn x3 dest rest rv rv'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn (dest # rest); x3 = dest # rest; rv' = tcb_ptr_to_ctcb_ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R3515 badge (ntfn_Ptr ntfnptr) ntfn (dest # rest) dest rest rv\<rbrace> setThreadState Structures_H.thread_state.Running dest \<lbrace>?Q3504 badgea ntfnPtr ntfn x3 dest rest rv rv'\<rbrace>
 3. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R3417 badgea ntfnPtr ntfn x3 dest rest\<rbrace> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) ntfn \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' dest a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread dest \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. dest \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R3515 badgea ntfnPtr ntfn x3 dest rest a\<rbrace>
 4. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. b) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = b\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'3520 badgea ntfnPtr ntfn x3 dest rest a b t rv})
 5. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> UNIV}}}}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 6. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfnptr)) xa and ko_at' ntfn ntfnptr and K (ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x) and ?R3417 badgea ntfnPtr ntfn x xa xb) s))) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}
flex-flex pairs:
\<lambda>ntfn dest rest rv t rva. ?Q'3521 ntfn dest rest rv rva (xfdc t) \<equiv>\<^sup>? \<lambda>ntfn dest rest rv. ?Q'3520 badge (ntfn_Ptr ntfnptr) ntfn (dest # rest) dest rest rv (tcb_ptr_to_ctcb_ptr dest) proof (prove)
goal (7 subgoals):
 1. \<And>badgea ntfnPtr ntfn x3 dest rest rv' xfdca rv xfdcb. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn (dest # rest); x3 = dest # rest; rv' = tcb_ptr_to_ctcb_ptr dest; dc rv xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3556 badgea ntfnPtr ntfn x3 dest rest rv' xfdca rv) (?Q'3575 ntfn dest rest xfdca rv xfdcb) (SKIP # hs) (possibleSwitchTo dest) (CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr dest))
 2. \<And>badgea ntfnPtr ntfn x3 dest rest rv' xfdc. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn (dest # rest); x3 = dest # rest; rv' = tcb_ptr_to_ctcb_ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R3569 badge (ntfn_Ptr ntfnptr) ntfn (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) ()\<rbrace> asUser dest (setRegister Notification_H.badgeRegister badge) \<lbrace>?Q3556 badgea ntfnPtr ntfn x3 dest rest rv' xfdc\<rbrace>
 3. \<And>badgea ntfnPtr ntfn x3 dest rest rv rv'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn (dest # rest); x3 = dest # rest; rv' = tcb_ptr_to_ctcb_ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R3515 badge (ntfn_Ptr ntfnptr) ntfn (dest # rest) dest rest rv\<rbrace> setThreadState Structures_H.thread_state.Running dest \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3569 badgea ntfnPtr ntfn x3 dest rest rv rv' a\<rbrace>
 4. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R3417 badgea ntfnPtr ntfn x3 dest rest\<rbrace> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) ntfn \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' dest a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread dest \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. dest \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R3515 badgea ntfnPtr ntfn x3 dest rest a\<rbrace>
 5. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. b) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = b\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. w_'_update (\<lambda>_. badgea) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. b) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = b\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badgea\<rbrace>} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?Q'3576 badgea ntfnPtr ntfn x3 dest rest a b t rv ta rva}})
 6. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> UNIV}}}}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 7. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfnptr)) xa and ko_at' ntfn ntfnptr and K (ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x) and ?R3417 badgea ntfnPtr ntfn x xa xb) s))) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}
flex-flex pairs:
\<lambda>ntfn dest rest rv. ?Q'3576 badge (ntfn_Ptr ntfnptr) ntfn (dest # rest) dest rest rv (tcb_ptr_to_ctcb_ptr dest) \<equiv>\<^sup>? \<lambda>ntfn dest rest rv t rva. ?Q'3574 ntfn dest rest rv rva (xfdc t)
\<lambda>ntfn dest rest xfdca t rv. ?Q'3575 ntfn dest rest xfdca rv (xfdc t) \<equiv>\<^sup>? \<lambda>ntfn dest rest. ?Q'3574 ntfn dest rest () () proof (prove)
goal (6 subgoals):
 1. \<And>badgea ntfnPtr ntfn x3 dest rest rv' xfdc. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn (dest # rest); x3 = dest # rest; rv' = tcb_ptr_to_ctcb_ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R3569 badge (ntfn_Ptr ntfnptr) ntfn (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) ()\<rbrace> asUser dest (setRegister Notification_H.badgeRegister badge) \<lbrace>\<lambda>a. Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and st_tcb_at' runnable' dest and (\<lambda>s. ksCurDomain s \<le> maxDomain) and valid_objs'\<rbrace>
 2. \<And>badgea ntfnPtr ntfn x3 dest rest rv rv'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn (dest # rest); x3 = dest # rest; rv' = tcb_ptr_to_ctcb_ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R3515 badge (ntfn_Ptr ntfnptr) ntfn (dest # rest) dest rest rv\<rbrace> setThreadState Structures_H.thread_state.Running dest \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3569 badgea ntfnPtr ntfn x3 dest rest rv rv' a\<rbrace>
 3. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R3417 badgea ntfnPtr ntfn x3 dest rest\<rbrace> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) ntfn \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' dest a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread dest \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. dest \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R3515 badgea ntfnPtr ntfn x3 dest rest a\<rbrace>
 4. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. b) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = b\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. w_'_update (\<lambda>_. badgea) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. b) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = b\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badgea\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. b) s \<in> \<lbrace>\<acute>target = b\<rbrace> \<inter> UNIV}}})
 5. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> UNIV}}}}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 6. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfnptr)) xa and ko_at' ntfn ntfnptr and K (ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x) and ?R3417 badgea ntfnPtr ntfn x xa xb) s))) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>badgea ntfnPtr ntfn x3 dest rest rv'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn (dest # rest); x3 = dest # rest; rv' = tcb_ptr_to_ctcb_ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R3569 badge (ntfn_Ptr ntfnptr) ntfn (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) ()\<rbrace> asUser dest (setRegister Notification_H.badgeRegister badge) \<lbrace>\<lambda>a b. Invariants_H.valid_queues b \<and> weak_sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' runnable' dest b \<and> ksCurDomain b \<le> maxDomain \<and> valid_objs' b\<rbrace>
 2. \<And>badgea ntfnPtr ntfn x3 dest rest rv rv'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn (dest # rest); x3 = dest # rest; rv' = tcb_ptr_to_ctcb_ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R3515 badge (ntfn_Ptr ntfnptr) ntfn (dest # rest) dest rest rv\<rbrace> setThreadState Structures_H.thread_state.Running dest \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3569 badgea ntfnPtr ntfn x3 dest rest rv rv' a\<rbrace>
 3. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R3417 badgea ntfnPtr ntfn x3 dest rest\<rbrace> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) ntfn \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' dest a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread dest \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. dest \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R3515 badgea ntfnPtr ntfn x3 dest rest a\<rbrace>
 4. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. b) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = b\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. w_'_update (\<lambda>_. badgea) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. b) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = b\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badgea\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. b) s \<in> \<lbrace>\<acute>target = b\<rbrace> \<inter> UNIV}}})
 5. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> UNIV}}}}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 6. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfnptr)) xa and ko_at' ntfn ntfnptr and K (ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x) and ?R3417 badgea ntfnPtr ntfn x xa xb) s))) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>badgea ntfnPtr ntfn x3 dest rest rv rv'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn (dest # rest); x3 = dest # rest; rv' = tcb_ptr_to_ctcb_ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R3515 badge (ntfn_Ptr ntfnptr) ntfn (dest # rest) dest rest rv\<rbrace> setThreadState Structures_H.thread_state.Running dest \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. Invariants_H.valid_queues a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' runnable' dest a \<and> ksCurDomain a \<le> maxDomain \<and> valid_objs' a)\<rbrace>
 2. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R3417 badgea ntfnPtr ntfn x3 dest rest\<rbrace> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) ntfn \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' dest a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread dest \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. dest \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R3515 badgea ntfnPtr ntfn x3 dest rest a\<rbrace>
 3. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. b) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = b\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. w_'_update (\<lambda>_. badgea) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. b) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = b\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badgea\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. b) s \<in> \<lbrace>\<acute>target = b\<rbrace> \<inter> UNIV}}})
 4. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> UNIV}}}}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 5. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfnptr)) xa and ko_at' ntfn ntfnptr and K (ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x) and ?R3417 badgea ntfnPtr ntfn x xa xb) s))) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R3417 badgea ntfnPtr ntfn x3 dest rest\<rbrace> setNotification ntfnptr $ ntfnObj_update (\<lambda>_. case rest of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn rest) ntfn \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' dest a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread dest \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. dest \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True \<and> (Invariants_H.valid_queues a \<and> ((\<exists>p. dest \<in> set (ksReadyQueues a p)) \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread dest \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> (if dest \<noteq> dest then st_tcb_at' runnable' dest else st_tcb_at' (\<lambda>_. True) dest) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_tcb_state' Structures_H.thread_state.Running and valid_objs') a)\<rbrace>
 2. \<And>badgea ntfnPtr ntfn x3 dest rest. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. b) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = b\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. w_'_update (\<lambda>_. badgea) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. b) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = b\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badgea\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. b) s \<in> \<lbrace>\<acute>target = b\<rbrace> \<inter> UNIV}}})
 3. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> UNIV}}}}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 4. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfnptr)) xa and ko_at' ntfn ntfnptr and K (ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x) and ?R3417 badgea ntfnPtr ntfn x xa xb) s))) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>ntfn dest rest. \<lbrakk>(\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn (dest # rest)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. (if SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Running then UNIV else {}) \<inter> {s'. \<forall>t. s'\<lparr>globals := globals t\<rparr> \<in> (if SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister = register_from_H Notification_H.badgeRegister then UNIV else {})})
 2. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> UNIV}}}}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 3. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfnptr)) xa and ko_at' ntfn ntfnptr and K (ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x) and (\<lambda>s. tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ntfn' (ntfnObj_update (\<lambda>_. case xb of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn xb) ntfn)) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>a. True) xa s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ntfn' (ntfnObj_update (\<lambda>_. case xb of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn xb) ntfn)) s)) s))) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>badgea ntfnPtr ntfn. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> UNIV}}}}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 2. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfnptr)) xa and ko_at' ntfn ntfnptr and K (ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x) and (\<lambda>s. tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ntfn' (ntfnObj_update (\<lambda>_. case xb of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn xb) ntfn)) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>a. True) xa s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ntfn' (ntfnObj_update (\<lambda>_. case xb of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn xb) ntfn)) s)) s))) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<And>badgea ntfnPtr s s'. \<lbrakk>badgea = badge; ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<lambda>s. (ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. receiveBlocked ts \<longrightarrow> (tcb_at' x and invs' and (\<lambda>a. tcb_at' x a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' (the (ntfnBoundTCB ntfn)) a \<and> (tcb_at' x and invs') a)) s) and (\<lambda>s. \<not> receiveBlocked ts \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and (\<lambda>_. \<not> isWaitingNtfn (ntfnObj ntfn))) s)) s))) and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (invs' and ko_at' ntfn ntfnptr) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfnptr)) xa and ko_at' ntfn ntfnptr and K (ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x) and (\<lambda>s. tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ntfn' (ntfnObj_update (\<lambda>_. case xb of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn xb) ntfn)) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>a. True) xa s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ntfn' (ntfnObj_update (\<lambda>_. case xb of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn xb) ntfn)) s)) s))) and (\<lambda>_. ntfnBoundTCB ntfn \<noteq> None \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<And>s s' ntfn. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ntfn ntfnptr s\<rbrakk> \<Longrightarrow> (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (ntfnBoundTCB ntfn = None \<longrightarrow> \<not> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> (receiveBlocked ts \<longrightarrow> tcb_at' x s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> tcb_at' x s) \<and> (\<not> receiveBlocked ts \<longrightarrow> \<not> isWaitingNtfn Structures_H.ntfn.IdleNtfn)))) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (\<forall>xa xb. x = xa # xb \<longrightarrow> st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfnptr)) xa s \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. case xb of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn xb) ntfn) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>a. True) xa s \<and> ksCurDomain s \<le> maxDomain \<and> valid_objs' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. case xb of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn xb) ntfn) s)) \<and> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) proof (prove)
goal (1 subgoal):
 1. \<And>s s' ntfn. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ntfn ntfnptr s\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (ntfnBoundTCB ntfn = None \<longrightarrow> \<not> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> (receiveBlocked ts \<longrightarrow> (((tcb_at' x s \<and> Invariants_H.valid_queues s) \<and> valid_objs' s) \<and> weak_sch_act_wf (ksSchedulerAction s) s) \<and> tcb_at' x s) \<and> (\<not> receiveBlocked ts \<longrightarrow> \<not> isWaitingNtfn Structures_H.ntfn.IdleNtfn)))) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (\<forall>xa xb. x = xa # xb \<longrightarrow> ((((((((((st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfnptr)) xa s \<and> tcb_at' xa s) \<and> Invariants_H.valid_queues s) \<and> valid_objs' s) \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. case xb of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn xb) ntfn) s) \<and> sch_act_wf (ksSchedulerAction s) s) \<and> Invariants_H.valid_queues s) \<and> weak_sch_act_wf (ksSchedulerAction s) s) \<and> st_tcb_at' (\<lambda>a. True) xa s) \<and> ksCurDomain s \<le> maxDomain) \<and> valid_objs' s) \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. case xb of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn xb) ntfn) s))) \<and> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL) proof (prove)
goal (2 subgoals):
 1. \<And>s s' ntfn. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ntfn ntfnptr s\<rbrakk> \<Longrightarrow> (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (ntfnBoundTCB ntfn = None \<longrightarrow> \<not> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> (receiveBlocked ts \<longrightarrow> (((tcb_at' x s \<and> Invariants_H.valid_queues s) \<and> valid_objs' s) \<and> weak_sch_act_wf (ksSchedulerAction s) s) \<and> tcb_at' x s) \<and> (\<not> receiveBlocked ts \<longrightarrow> \<not> isWaitingNtfn Structures_H.ntfn.IdleNtfn)))) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (\<forall>xa xb. x = xa # xb \<longrightarrow> ((((((((((st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfnptr)) xa s \<and> tcb_at' xa s) \<and> Invariants_H.valid_queues s) \<and> valid_objs' s) \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. case xb of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn xb) ntfn) s) \<and> sch_act_wf (ksSchedulerAction s) s) \<and> Invariants_H.valid_queues s) \<and> weak_sch_act_wf (ksSchedulerAction s) s) \<and> st_tcb_at' (\<lambda>a. True) xa s) \<and> ksCurDomain s \<le> maxDomain) \<and> valid_objs' s) \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. case xb of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn xb) ntfn) s))
 2. \<And>s s' ntfn. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ntfn ntfnptr s\<rbrakk> \<Longrightarrow> (\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL proof (prove)
goal (2 subgoals):
 1. \<And>s s' ntfn. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ntfn ntfnptr s; valid_obj' (KONotification ntfn) s\<rbrakk> \<Longrightarrow> (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (ntfnBoundTCB ntfn = None \<longrightarrow> \<not> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> (receiveBlocked ts \<longrightarrow> tcb_at' x s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> tcb_at' x s) \<and> (\<not> receiveBlocked ts \<longrightarrow> \<not> isWaitingNtfn Structures_H.ntfn.IdleNtfn)))) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (\<forall>xa xb. x = xa # xb \<longrightarrow> st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfnptr)) xa s \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. case xb of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn xb) ntfn) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>a. True) xa s \<and> ksCurDomain s \<le> maxDomain \<and> valid_objs' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. case xb of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn xb) ntfn) s))
 2. \<And>s s' ntfn. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ntfn ntfnptr s\<rbrakk> \<Longrightarrow> (\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL proof (prove)
goal (2 subgoals):
 1. \<And>s s' ntfn. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ntfn ntfnptr s; valid_ntfn' ntfn s\<rbrakk> \<Longrightarrow> (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (ntfnBoundTCB ntfn = None \<longrightarrow> \<not> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<and> (\<forall>x. ntfnBoundTCB ntfn = Some x \<longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) x s \<longrightarrow> (receiveBlocked ts \<longrightarrow> tcb_at' x s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> tcb_at' x s) \<and> (\<not> receiveBlocked ts \<longrightarrow> \<not> isWaitingNtfn Structures_H.ntfn.IdleNtfn)))) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (\<forall>xa xb. x = xa # xb \<longrightarrow> st_tcb_at' ((=) (Structures_H.thread_state.BlockedOnNotification ntfnptr)) xa s \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. case xb of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn xb) ntfn) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>a. True) xa s \<and> ksCurDomain s \<le> maxDomain \<and> valid_objs' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. case xb of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn xb) ntfn) s))
 2. \<And>s s' ntfn. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ntfn ntfnptr s\<rbrakk> \<Longrightarrow> (\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL proof (prove)
goal (1 subgoal):
 1. \<And>s s' ntfn. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ntfn ntfnptr s\<rbrakk> \<Longrightarrow> (\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> NULL proof (prove)
goal (1 subgoal):
 1. \<And>s s' ntfn. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ntfn ntfnptr s; ntfnBoundTCB ntfn = Some 0xFFFFFF00\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>s s' ntfn. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ntfn ntfnptr s; ntfnBoundTCB ntfn = Some 0xFFFFFF00; valid_ntfn' ntfn s\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals!