theory Ipc_C

lemma completeSignal_ccorres:
  notes if_split[split del]
  shows
  "ccorres dc xfdc (invs' and tcb_at' thread)
     (UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace>
           \<inter> \<lbrace>\<acute>ntfnPtr = Ptr ntfnptr\<rbrace>) hs
     (completeSignal ntfnptr thread)
     (Call completeSignal_'proc)" apply (cinit lift: tcb_' ntfnPtr_') apply (rule_tac P="invs' and tcb_at' thread" in ccorres_gen_asm_state) apply clarsimp apply (subgoal_tac "tcb_ptr_to_ctcb_ptr thread \<noteq> NULL") prefer 2 apply (clarsimp simp: invs'_def valid_state'_def valid_pspace'_def
                          tcb_ptr_to_ctcb_ptr_def) apply (drule sum_to_zero) apply (clarsimp simp: obj_at'_def ctcb_offset_defs projectKOs objBits_simps'
                          is_aligned_def) apply clarsimp apply csymbr apply simp apply (rule ccorres_rhs_assoc)+ apply (rule ccorres_pre_getNotification, rename_tac ntfn) apply (rule_tac xf'=ret__unsigned_'
                and val="case ntfnObj ntfn of IdleNtfn \<Rightarrow> scast NtfnState_Idle
                                  | WaitingNtfn _ \<Rightarrow> scast NtfnState_Waiting
                                  | ActiveNtfn _ \<Rightarrow> scast NtfnState_Active"
                and R="ko_at' ntfn ntfnptr"
                 in ccorres_symb_exec_r_known_rv_UNIV[where R'=UNIV]) apply vcg apply clarsimp apply (erule(1) cmap_relation_ko_atE [OF cmap_relation_ntfn]) apply (clarsimp simp: cnotification_relation_def Let_def typ_heap_simps
                     split: Structures_H.ntfn.splits) apply ceqv apply wpc
    \<comment> \<open>IdleNtfn case\<close> apply (clarsimp simp: NtfnState_Idle_def NtfnState_Active_def) apply csymbr apply (rule ccorres_cond_false) apply (rule ccorres_fail)
      \<comment> \<open>ActiveNtfn case\<close> apply (clarsimp, csymbr, rule ccorres_cond_true) apply (rule ccorres_rhs_assoc)+ apply (rule ccorres_rhs_assoc2) apply (rename_tac word) apply (rule_tac val=word and xf'=badge_' and R="ko_at' ntfn ntfnptr"
                   in ccorres_symb_exec_r_known_rv_UNIV[where R'=UNIV]) apply (vcg, clarsimp) apply (erule(1) cmap_relation_ko_atE[OF cmap_relation_ntfn]) apply (clarsimp simp: cnotification_relation_def Let_def typ_heap_simps) apply ceqv apply (ctac(no_vcg)) apply (rule_tac P="invs' and ko_at' ntfn ntfnptr" and P'=UNIV in ccorres_from_vcg) apply (rule allI, rule conseqPre, vcg) apply (clarsimp) apply (frule(1) cmap_relation_ko_atD [OF cmap_relation_ntfn]) apply (clarsimp simp: typ_heap_simps setNotification_def) apply (rule bexI [OF _ setObject_eq]) apply (simp add: rf_sr_def cstate_relation_def Let_def update_ntfn_map_tos
                            cpspace_relation_def typ_heap_simps') apply (elim conjE) apply (intro conjI) apply (rule cpspace_relation_ntfn_update_ntfn, assumption+) apply (simp add: cnotification_relation_def Let_def NtfnState_Idle_def mask_def) apply simp apply (simp add: carch_state_relation_def typ_heap_simps') apply (simp add: cmachine_state_relation_def) apply (simp add: h_t_valid_clift_Some_iff) apply (simp add: objBits_simps') apply (simp add: objBits_simps) apply assumption apply wp apply (clarsimp simp: guard_is_UNIV_def ARM_H.badgeRegister_def
                           ARM.badgeRegister_def Kernel_C.badgeRegister_def
                           Kernel_C.R0_def)
    \<comment> \<open>WaitingNtfn case\<close> apply (clarsimp simp: NtfnState_Active_def NtfnState_Waiting_def) apply csymbr apply (rule ccorres_cond_false) apply (rule ccorres_fail) apply (clarsimp simp: guard_is_UNIV_def) apply (clarsimp) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (invs' and tcb_at' thread) (UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr ntfnptr\<rbrace>) hs (completeSignal ntfnptr thread) (Call completeSignal_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>ntfnPtr tcb. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q624 ntfnPtr tcb) (?Q'624 ntfnPtr tcb) (SKIP # hs) (do ntfn <- getNotification ntfnptr;
case ntfnObj ntfn of Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | _ \<Rightarrow> haskell_fail []
od) (\<acute>ret__int :== (if tcb \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI))
 2. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q624 ntfnPtr tcb s \<and> s' \<in> ?Q'624 ntfnPtr tcb proof (prove)
goal (2 subgoals):
 1. \<And>ntfnPtr tcb s. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (invs' and tcb_at' thread) s\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G630 ntfnPtr tcb) (?Q'624 ntfnPtr tcb) (SKIP # hs) (do ntfn <- getNotification ntfnptr;
case ntfnObj ntfn of Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | _ \<Rightarrow> haskell_fail []
od) (\<acute>ret__int :== (if tcb \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfnPtr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI))
 2. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G630 ntfnPtr tcb and (invs' and tcb_at' thread)) s \<and> s' \<in> ?Q'624 ntfnPtr tcb proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>invs' s; tcb_at' thread s\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G630 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread)) (?Q'624 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread)) (SKIP # hs) (do ntfn <- getNotification ntfnptr;
case ntfnObj ntfn of Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | _ \<Rightarrow> haskell_fail []
od) (\<acute>ret__int :== (if tcb_ptr_to_ctcb_ptr thread \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(ntfn_Ptr ntfnptr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI))
 2. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G630 ntfnPtr tcb and (invs' and tcb_at' thread)) s \<and> s' \<in> ?Q'624 ntfnPtr tcb proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G630 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread)) (?Q'624 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread)) (SKIP # hs) (do ntfn <- getNotification ntfnptr;
case ntfnObj ntfn of Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | _ \<Rightarrow> haskell_fail []
od) (\<acute>ret__int :== (if tcb_ptr_to_ctcb_ptr thread \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(ntfn_Ptr ntfnptr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI))
 2. \<And>s. \<lbrakk>invs' s; tcb_at' thread s\<rbrakk> \<Longrightarrow> tcb_ptr_to_ctcb_ptr thread \<noteq> NULL
 3. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G630 ntfnPtr tcb and (invs' and tcb_at' thread)) s \<and> s' \<in> ?Q'624 ntfnPtr tcb proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>invs' s; tcb_at' thread s\<rbrakk> \<Longrightarrow> tcb_ptr_to_ctcb_ptr thread \<noteq> NULL
 2. \<And>s. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G630 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread)) (?Q'624 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread)) (SKIP # hs) (do ntfn <- getNotification ntfnptr;
case ntfnObj ntfn of Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | _ \<Rightarrow> haskell_fail []
od) (\<acute>ret__int :== (if tcb_ptr_to_ctcb_ptr thread \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(ntfn_Ptr ntfnptr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI))
 3. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G630 ntfnPtr tcb and (invs' and tcb_at' thread)) s \<and> s' \<in> ?Q'624 ntfnPtr tcb proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>tcb_at' thread s; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; kernel_state.ksDomSchedule s = kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; thread + ctcb_offset = 0\<rbrakk> \<Longrightarrow> False
 2. \<And>s. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G630 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread)) (?Q'624 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread)) (SKIP # hs) (do ntfn <- getNotification ntfnptr;
case ntfnObj ntfn of Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | _ \<Rightarrow> haskell_fail []
od) (\<acute>ret__int :== (if tcb_ptr_to_ctcb_ptr thread \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(ntfn_Ptr ntfnptr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI))
 3. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G630 ntfnPtr tcb and (invs' and tcb_at' thread)) s \<and> s' \<in> ?Q'624 ntfnPtr tcb proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>tcb_at' thread s; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; kernel_state.ksDomSchedule s = kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; thread = - ctcb_offset\<rbrakk> \<Longrightarrow> False
 2. \<And>s. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G630 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread)) (?Q'624 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread)) (SKIP # hs) (do ntfn <- getNotification ntfnptr;
case ntfnObj ntfn of Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | _ \<Rightarrow> haskell_fail []
od) (\<acute>ret__int :== (if tcb_ptr_to_ctcb_ptr thread \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(ntfn_Ptr ntfnptr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI))
 3. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G630 ntfnPtr tcb and (invs' and tcb_at' thread)) s \<and> s' \<in> ?Q'624 ntfnPtr tcb proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G630 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread)) (?Q'624 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread)) (SKIP # hs) (do ntfn <- getNotification ntfnptr;
case ntfnObj ntfn of Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | _ \<Rightarrow> haskell_fail []
od) (\<acute>ret__int :== (if tcb_ptr_to_ctcb_ptr thread \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(ntfn_Ptr ntfnptr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI))
 2. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G630 ntfnPtr tcb and (invs' and tcb_at' thread)) s \<and> s' \<in> ?Q'624 ntfnPtr tcb proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G630 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread)) (?Q'624 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread)) (SKIP # hs) (do ntfn <- getNotification ntfnptr;
case ntfnObj ntfn of Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | _ \<Rightarrow> haskell_fail []
od) (\<acute>ret__int :== 1;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(ntfn_Ptr ntfnptr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI))
 2. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G630 ntfnPtr tcb and (invs' and tcb_at' thread)) s \<and> s' \<in> ?Q'624 ntfnPtr tcb proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G630 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread)) (?G'695 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread)) (SKIP # hs) (do ntfn <- getNotification ntfnptr;
case ntfnObj ntfn of Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | _ \<Rightarrow> haskell_fail []
od) (IF 1 \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(ntfn_Ptr ntfnptr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 2. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G630 ntfnPtr tcb and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> ?G'695 ntfnPtr tcb} proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G630 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread)) (?G'695 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread)) (SKIP # hs) (do ntfn <- getNotification ntfnptr;
case ntfnObj ntfn of Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | _ \<Rightarrow> haskell_fail []
od) (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(ntfn_Ptr ntfnptr);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 2. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G630 ntfnPtr tcb and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> ?G'695 ntfnPtr tcb} proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G630 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread)) (?G'695 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread)) (SKIP # hs) (do ntfn <- getNotification ntfnptr;
case ntfnObj ntfn of Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | _ \<Rightarrow> haskell_fail []
od) (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(ntfn_Ptr ntfnptr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI))
 2. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G630 ntfnPtr tcb and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> ?G'695 ntfnPtr tcb} proof (prove)
goal (2 subgoals):
 1. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?P801 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) a ntfn) (?P'802 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn) (SKIP # hs) (case ntfnObj ntfn of Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | _ \<Rightarrow> haskell_fail []) (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(ntfn_Ptr ntfnptr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI))
 2. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ?P801 ntfnPtr tcb a ntfn) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> ?P'802 ntfnPtr tcb ntfn}} proof (prove)
goal (5 subgoals):
 1. \<And>s ntfn sa. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. ko_at' ntfn ntfnptr sa \<and> (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(ntfn_Ptr ntfnptr) ({s'. (sa, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)\<rbrace>)
 2. \<And>s ntfn rv' t t'. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI) (?y'806 s ntfn rv')
 3. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P809 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn) (?Q806 s ntfn) (SKIP # hs) (case ntfnObj ntfn of Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | _ \<Rightarrow> haskell_fail []) (?y'806 s ntfn (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting))
 4. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. ?Q806 s ntfn)
 5. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> (?P809 ntfnPtr tcb ntfn and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (5 subgoals):
 1. \<And>s ntfn sa. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> UNIV \<inter> {s'. ko_at' ntfn ntfnptr sa \<and> (sa, s') \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ret__unsigned. ret__unsigned = notification_CL.state_CL (notification_lift (the (cslift s (ntfn_Ptr ntfnptr)))) \<longrightarrow> (sa, s\<lparr>ret__unsigned_' := notification_CL.state_CL (notification_lift (the (cslift s (ntfn_Ptr ntfnptr))))\<rparr>) \<in> rf_sr \<and> notification_CL.state_CL (notification_lift (the (cslift s (ntfn_Ptr ntfnptr)))) = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting))}
 2. \<And>s ntfn rv' t t'. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI) (?y'806 s ntfn rv')
 3. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P809 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn) (?Q806 s ntfn) (SKIP # hs) (case ntfnObj ntfn of Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | _ \<Rightarrow> haskell_fail []) (?y'806 s ntfn (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting))
 4. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. ?Q806 s ntfn)
 5. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> (?P809 ntfnPtr tcb ntfn and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (5 subgoals):
 1. \<And>s ntfn sa x. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ko_at' ntfn ntfnptr sa; (sa, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> notification_CL.state_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)
 2. \<And>s ntfn rv' t t'. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI) (?y'806 s ntfn rv')
 3. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P809 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn) (?Q806 s ntfn) (SKIP # hs) (case ntfnObj ntfn of Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | _ \<Rightarrow> haskell_fail []) (?y'806 s ntfn (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting))
 4. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. ?Q806 s ntfn)
 5. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> (?P809 ntfnPtr tcb ntfn and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (5 subgoals):
 1. \<And>s ntfn sa x ko'. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ko_at' ntfn ntfnptr sa; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> notification_CL.state_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)
 2. \<And>s ntfn rv' t t'. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI) (?y'806 s ntfn rv')
 3. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P809 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn) (?Q806 s ntfn) (SKIP # hs) (case ntfnObj ntfn of Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | _ \<Rightarrow> haskell_fail []) (?y'806 s ntfn (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting))
 4. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. ?Q806 s ntfn)
 5. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> (?P809 ntfnPtr tcb ntfn and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (4 subgoals):
 1. \<And>s ntfn rv' t t'. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI) (?y'806 s ntfn rv')
 2. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P809 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn) (?Q806 s ntfn) (SKIP # hs) (case ntfnObj ntfn of Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | _ \<Rightarrow> haskell_fail []) (?y'806 s ntfn (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting))
 3. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. ?Q806 s ntfn)
 4. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> (?P809 ntfnPtr tcb ntfn and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (3 subgoals):
 1. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P809 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn) (?Q806 s ntfn) (SKIP # hs) (case ntfnObj ntfn of Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | _ \<Rightarrow> haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 2. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. ?Q806 s ntfn)
 3. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> (?P809 ntfnPtr tcb ntfn and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (5 subgoals):
 1. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R974 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn) (?R''967 s ntfn) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 2. \<And>s ntfn x2. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R983 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn x2) (?R''966 s ntfn x2) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister x2;
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 4. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {sa. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> sa \<in> ?R''967 s ntfn} \<inter> ({sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> sa \<in> ?R''966 s ntfn x}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 5. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ?R974 ntfnPtr tcb ntfn a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R983 ntfnPtr tcb ntfn x a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (5 subgoals):
 1. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R974 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn) (?R''967 s ntfn) (SKIP # hs) fail (\<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0)
ELSE
  Guard DontReach {} SKIP
FI)
 2. \<And>s ntfn x2. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R983 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn x2) (?R''966 s ntfn x2) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister x2;
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 4. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {sa. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> sa \<in> ?R''967 s ntfn} \<inter> ({sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> sa \<in> ?R''966 s ntfn x}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 5. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ?R974 ntfnPtr tcb ntfn a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R983 ntfnPtr tcb ntfn x a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (5 subgoals):
 1. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R974 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn) (?G'991 s ntfn) (SKIP # hs) fail (IF 0 \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0)
ELSE
  Guard DontReach {} SKIP
FI)
 2. \<And>s ntfn x2. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R983 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn x2) (?R''966 s ntfn x2) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister x2;
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 4. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {sa. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := 0\<rparr> \<in> ?G'991 s ntfn}} \<inter> ({sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> sa \<in> ?R''966 s ntfn x}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 5. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ?R974 ntfnPtr tcb ntfn a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R983 ntfnPtr tcb ntfn x a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (5 subgoals):
 1. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R974 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn) (?R'1117 s ntfn) (SKIP # hs) fail (Guard DontReach {} SKIP)
 2. \<And>s ntfn x2. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R983 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn x2) (?R''966 s ntfn x2) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister x2;
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 4. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {sa. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := 0\<rparr> \<in> ?R'1117 s ntfn \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> sa \<in> ?R''966 s ntfn x}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 5. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ?R974 ntfnPtr tcb ntfn a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R983 ntfnPtr tcb ntfn x a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (4 subgoals):
 1. \<And>s ntfn x2. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R983 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn x2) (?R''966 s ntfn x2) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister x2;
setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 2. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> sa \<in> ?R''966 s ntfn x}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 4. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R983 ntfnPtr tcb ntfn x a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (4 subgoals):
 1. \<And>s ntfn x2. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R983 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn x2) (?R'1252 s ntfn x2) (SKIP # hs) (do a <- asUser thread (setRegister Notification_H.badgeRegister x2);
setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn)
od) (\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle))
 2. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := 1\<rparr> \<in> ?R'1252 s ntfn x \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 4. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R983 ntfnPtr tcb ntfn x a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (4 subgoals):
 1. \<And>s ntfn x2. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R983 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn x2) (?R'1252 s ntfn x2) (SKIP # hs) (do a <- asUser thread (setRegister Notification_H.badgeRegister x2);
setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn)
od) (\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
(\<acute>badge :== \<acute>ret__unsigned;;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle))))
 2. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := 1\<rparr> \<in> ?R'1252 s ntfn x \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 4. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R983 ntfnPtr tcb ntfn x a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (4 subgoals):
 1. \<And>s ntfn x2. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R983 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn x2) (?R'1252 s ntfn x2) (SKIP # hs) (do a <- asUser thread (setRegister Notification_H.badgeRegister x2);
setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn)
od) (\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)))
 2. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := 1\<rparr> \<in> ?R'1252 s ntfn x \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 4. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R983 ntfnPtr tcb ntfn x a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (4 subgoals):
 1. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R983 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn word) (?R'1252 s ntfn word) (SKIP # hs) (do a <- asUser thread (setRegister Notification_H.badgeRegister word);
setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn)
od) (\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)))
 2. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := 1\<rparr> \<in> ?R'1252 s ntfn x \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 4. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R983 ntfnPtr tcb ntfn x a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (7 subgoals):
 1. \<And>s ntfn word sa. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. ko_at' ntfn ntfnptr sa \<and> (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned ({s'. (sa, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>badge = word\<rbrace>)
 2. \<And>s ntfn word rv' t t'. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> ceqv \<Gamma> badge_' rv' t t' (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)) (?y'1264 s ntfn word rv')
 3. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1267 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn word) (?Q1264 s ntfn word) (SKIP # hs) (do a <- asUser thread (setRegister Notification_H.badgeRegister word);
setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn)
od) (?y'1264 s ntfn word word)
 4. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word) badge_' (\<lambda>rv rv'. ?Q1264 s ntfn word)
 5. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 6. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 7. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (?P1267 ntfnPtr tcb ntfn x and ko_at' ntfn ntfnptr) a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (7 subgoals):
 1. \<And>s ntfn word sa x. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; ko_at' ntfn ntfnptr sa; (sa, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> ntfnMsgIdentifier_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = word
 2. \<And>s ntfn word rv' t t'. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> ceqv \<Gamma> badge_' rv' t t' (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)) (?y'1264 s ntfn word rv')
 3. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1267 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn word) (?Q1264 s ntfn word) (SKIP # hs) (do a <- asUser thread (setRegister Notification_H.badgeRegister word);
setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn)
od) (?y'1264 s ntfn word word)
 4. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word) badge_' (\<lambda>rv rv'. ?Q1264 s ntfn word)
 5. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 6. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 7. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (?P1267 ntfnPtr tcb ntfn x and ko_at' ntfn ntfnptr) a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (7 subgoals):
 1. \<And>s ntfn word sa x ko'. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; ko_at' ntfn ntfnptr sa; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> ntfnMsgIdentifier_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = word
 2. \<And>s ntfn word rv' t t'. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> ceqv \<Gamma> badge_' rv' t t' (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)) (?y'1264 s ntfn word rv')
 3. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1267 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn word) (?Q1264 s ntfn word) (SKIP # hs) (do a <- asUser thread (setRegister Notification_H.badgeRegister word);
setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn)
od) (?y'1264 s ntfn word word)
 4. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word) badge_' (\<lambda>rv rv'. ?Q1264 s ntfn word)
 5. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 6. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 7. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (?P1267 ntfnPtr tcb ntfn x and ko_at' ntfn ntfnptr) a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (6 subgoals):
 1. \<And>s ntfn word rv' t t'. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> ceqv \<Gamma> badge_' rv' t t' (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)) (?y'1264 s ntfn word rv')
 2. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1267 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn word) (?Q1264 s ntfn word) (SKIP # hs) (do a <- asUser thread (setRegister Notification_H.badgeRegister word);
setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn)
od) (?y'1264 s ntfn word word)
 3. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word) badge_' (\<lambda>rv rv'. ?Q1264 s ntfn word)
 4. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 5. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 6. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (?P1267 ntfnPtr tcb ntfn x and ko_at' ntfn ntfnptr) a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (5 subgoals):
 1. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1267 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn word) (?Q1264 s ntfn word) (SKIP # hs) (do a <- asUser thread (setRegister Notification_H.badgeRegister word);
setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn)
od) (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,word);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle))
 2. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word) badge_' (\<lambda>rv rv'. ?Q1264 s ntfn word)
 3. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 4. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 5. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (?P1267 ntfnPtr tcb ntfn x and ko_at' ntfn ntfnptr) a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (6 subgoals):
 1. \<And>s ntfn word rv xfdca. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; dc rv xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1349 s ntfn word rv) (?Q'1349 s ntfn word rv xfdca) (SKIP # hs) (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn)) (CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle))
 2. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> \<lbrace>?R1353 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn word\<rbrace> asUser thread (setRegister Notification_H.badgeRegister word) \<lbrace>?Q1349 s ntfn word\<rbrace>
 3. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word) badge_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. word) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = word\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'1349 s ntfn word rv (xfdc t)})
 4. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 5. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 6. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and ?R1353 ntfnPtr tcb ntfn x and ko_at' ntfn ntfnptr) a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (6 subgoals):
 1. \<And>s ntfn word rv xfdca. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; dc rv xfdca\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (invs' and ko_at' ntfn ntfnptr) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle) {s. \<exists>(rv, \<sigma>')\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)}
 2. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> \<lbrace>?R1353 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn word\<rbrace> asUser thread (setRegister Notification_H.badgeRegister word) \<lbrace>\<lambda>a. invs' and ko_at' ntfn ntfnptr\<rbrace>
 3. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word) badge_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. word) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = word\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 4. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 5. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 6. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and ?R1353 ntfnPtr tcb ntfn x and ko_at' ntfn ntfnptr) a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (6 subgoals):
 1. \<And>s ntfn word rv xfdca \<sigma>. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; dc rv xfdca\<rbrakk> \<Longrightarrow> {s. (invs' and ko_at' ntfn ntfnptr) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift (the (cslift s (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals s))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<sigma>). (\<sigma>', s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr \<and> dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>))))}
 2. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> \<lbrace>?R1353 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn word\<rbrace> asUser thread (setRegister Notification_H.badgeRegister word) \<lbrace>\<lambda>a. invs' and ko_at' ntfn ntfnptr\<rbrace>
 3. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word) badge_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. word) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = word\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 4. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 5. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 6. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and ?R1353 ntfnPtr tcb ntfn x and ko_at' ntfn ntfnptr) a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (6 subgoals):
 1. \<And>s ntfn word \<sigma> x. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))
 2. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> \<lbrace>?R1353 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn word\<rbrace> asUser thread (setRegister Notification_H.badgeRegister word) \<lbrace>\<lambda>a. invs' and ko_at' ntfn ntfnptr\<rbrace>
 3. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word) badge_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. word) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = word\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 4. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 5. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 6. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and ?R1353 ntfnPtr tcb ntfn x and ko_at' ntfn ntfnptr) a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (6 subgoals):
 1. \<And>s ntfn word \<sigma> x. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; \<exists>ko'. cslift x (ntfn_Ptr ntfnptr) = Some ko' \<and> cnotification_relation (cslift x) ntfn ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))
 2. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> \<lbrace>?R1353 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn word\<rbrace> asUser thread (setRegister Notification_H.badgeRegister word) \<lbrace>\<lambda>a. invs' and ko_at' ntfn ntfnptr\<rbrace>
 3. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word) badge_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. word) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = word\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 4. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 5. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 6. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and ?R1353 ntfnPtr tcb ntfn x and ko_at' ntfn ntfnptr) a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (6 subgoals):
 1. \<And>s ntfn word \<sigma> x ko' t notification. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setObject ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> \<lbrace>?R1353 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn word\<rbrace> asUser thread (setRegister Notification_H.badgeRegister word) \<lbrace>\<lambda>a. invs' and ko_at' ntfn ntfnptr\<rbrace>
 3. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word) badge_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. word) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = word\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 4. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 5. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 6. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and ?R1353 ntfnPtr tcb ntfn x and ko_at' ntfn ntfnptr) a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (10 subgoals):
 1. \<And>s ntfn word \<sigma> x ko' t notification. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> case ((), \<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> injectKOS (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn))\<rparr>) of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>s ntfn word \<sigma> x ko' t notification val old ptr ptr' next. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>s ntfn word \<sigma> x ko' t notification v. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>s ntfn word \<sigma> x ko' t notification v v'. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>s ntfn word \<sigma> x ko' t notification. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P1427 s ntfn word \<sigma> x ko' t notification) ntfnptr \<sigma>
 6. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> \<lbrace>?R1353 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn word\<rbrace> asUser thread (setRegister Notification_H.badgeRegister word) \<lbrace>\<lambda>a. invs' and ko_at' ntfn ntfnptr\<rbrace>
 7. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word) badge_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. word) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = word\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 8. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 9. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 10. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and ?R1353 ntfnPtr tcb ntfn x and ko_at' ntfn ntfnptr) a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (10 subgoals):
 1. \<And>s ntfn word \<sigma> x ko' t notification. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)) \<and> cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation \<and> cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr \<and> carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>) \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>) \<and> ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<and> ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>) \<and> cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState \<sigma>) (globals x) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x) \<and> cte_array_relation \<sigma> (globals x) \<and> tcb_cte_array_relation \<sigma> (globals x) \<and> apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>) \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>) \<and> ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma> \<and> x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr \<and> {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs \<and> x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr \<and> {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs \<and> htd_safe domain (hrs_htd (t_hrs_' (globals x))) \<and> - domain \<subseteq> kernel_data_refs \<and> globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list \<and> cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule \<and> ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>) \<and> ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>) \<and> ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> notification)) ntfn_Ptr (cnotification_relation (cslift x)) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>)
 2. \<And>s ntfn word \<sigma> x ko' t notification val old ptr ptr' next. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>s ntfn word \<sigma> x ko' t notification v. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>s ntfn word \<sigma> x ko' t notification v v'. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>s ntfn word \<sigma> x ko' t notification. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P1427 s ntfn word \<sigma> x ko' t notification) ntfnptr \<sigma>
 6. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> \<lbrace>?R1353 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn word\<rbrace> asUser thread (setRegister Notification_H.badgeRegister word) \<lbrace>\<lambda>a. invs' and ko_at' ntfn ntfnptr\<rbrace>
 7. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word) badge_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. word) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = word\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 8. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 9. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 10. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and ?R1353 ntfnPtr tcb ntfn x and ko_at' ntfn ntfnptr) a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (10 subgoals):
 1. \<And>s ntfn word \<sigma> x ko' t notification. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> notification)) ntfn_Ptr (cnotification_relation (cslift x)) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>)
 2. \<And>s ntfn word \<sigma> x ko' t notification val old ptr ptr' next. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>s ntfn word \<sigma> x ko' t notification v. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>s ntfn word \<sigma> x ko' t notification v v'. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>s ntfn word \<sigma> x ko' t notification. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P1427 s ntfn word \<sigma> x ko' t notification) ntfnptr \<sigma>
 6. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> \<lbrace>?R1353 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn word\<rbrace> asUser thread (setRegister Notification_H.badgeRegister word) \<lbrace>\<lambda>a. invs' and ko_at' ntfn ntfnptr\<rbrace>
 7. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word) badge_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. word) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = word\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 8. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 9. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 10. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and ?R1353 ntfnPtr tcb ntfn x and ko_at' ntfn ntfnptr) a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (12 subgoals):
 1. \<And>s ntfn word \<sigma> x ko' t notification. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> notification)) ntfn_Ptr (cnotification_relation (cslift x))
 2. \<And>s ntfn word \<sigma> x ko' t notification. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>)
 3. \<And>s ntfn word \<sigma> x ko' t notification. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>)
 4. \<And>s ntfn word \<sigma> x ko' t notification val old ptr ptr' next. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>s ntfn word \<sigma> x ko' t notification v. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>s ntfn word \<sigma> x ko' t notification v v'. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>s ntfn word \<sigma> x ko' t notification. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P1427 s ntfn word \<sigma> x ko' t notification) ntfnptr \<sigma>
 8. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> \<lbrace>?R1353 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn word\<rbrace> asUser thread (setRegister Notification_H.badgeRegister word) \<lbrace>\<lambda>a. invs' and ko_at' ntfn ntfnptr\<rbrace>
 9. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word) badge_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. word) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = word\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 10. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s ntfn word \<sigma> x ko' t notification. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cnotification_relation (cslift x) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) notification
 2. \<And>s ntfn word \<sigma> x ko' t notification. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn) then set (ntfnQueue (ntfnObj ntfn)) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn) then set (ntfnQueue (ntfnObj ntfn)) else {}))\<^esub>
 3. \<And>s ntfn word \<sigma> x ko' t notification. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>)
 4. \<And>s ntfn word \<sigma> x ko' t notification. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>)
 5. \<And>s ntfn word \<sigma> x ko' t notification val old ptr ptr' next. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>s ntfn word \<sigma> x ko' t notification v. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>s ntfn word \<sigma> x ko' t notification v v'. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>s ntfn word \<sigma> x ko' t notification. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P1427 s ntfn word \<sigma> x ko' t notification) ntfnptr \<sigma>
 9. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> \<lbrace>?R1353 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn word\<rbrace> asUser thread (setRegister Notification_H.badgeRegister word) \<lbrace>\<lambda>a. invs' and ko_at' ntfn ntfnptr\<rbrace>
 10. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word) badge_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. word) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = word\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s ntfn word \<sigma> x ko' t notification. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn) then set (ntfnQueue (ntfnObj ntfn)) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn) then set (ntfnQueue (ntfnObj ntfn)) else {}))\<^esub>
 2. \<And>s ntfn word \<sigma> x ko' t notification. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>)
 3. \<And>s ntfn word \<sigma> x ko' t notification. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>)
 4. \<And>s ntfn word \<sigma> x ko' t notification val old ptr ptr' next. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>s ntfn word \<sigma> x ko' t notification v. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>s ntfn word \<sigma> x ko' t notification v v'. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>s ntfn word \<sigma> x ko' t notification. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P1427 s ntfn word \<sigma> x ko' t notification) ntfnptr \<sigma>
 8. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> \<lbrace>?R1353 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn word\<rbrace> asUser thread (setRegister Notification_H.badgeRegister word) \<lbrace>\<lambda>a. invs' and ko_at' ntfn ntfnptr\<rbrace>
 9. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word) badge_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. word) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = word\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 10. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s ntfn word \<sigma> x ko' t notification. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>)
 2. \<And>s ntfn word \<sigma> x ko' t notification. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>)
 3. \<And>s ntfn word \<sigma> x ko' t notification val old ptr ptr' next. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 4. \<And>s ntfn word \<sigma> x ko' t notification v. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 5. \<And>s ntfn word \<sigma> x ko' t notification v v'. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 6. \<And>s ntfn word \<sigma> x ko' t notification. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P1427 s ntfn word \<sigma> x ko' t notification) ntfnptr \<sigma>
 7. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> \<lbrace>?R1353 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn word\<rbrace> asUser thread (setRegister Notification_H.badgeRegister word) \<lbrace>\<lambda>a. invs' and ko_at' ntfn ntfnptr\<rbrace>
 8. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word) badge_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. word) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = word\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 9. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 10. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s ntfn word \<sigma> x ko' t notification. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rparr>)
 2. \<And>s ntfn word \<sigma> x ko' t notification val old ptr ptr' next. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>s ntfn word \<sigma> x ko' t notification v. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>s ntfn word \<sigma> x ko' t notification v v'. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>s ntfn word \<sigma> x ko' t notification. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P1427 s ntfn word \<sigma> x ko' t notification) ntfnptr \<sigma>
 6. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> \<lbrace>?R1353 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn word\<rbrace> asUser thread (setRegister Notification_H.badgeRegister word) \<lbrace>\<lambda>a. invs' and ko_at' ntfn ntfnptr\<rbrace>
 7. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word) badge_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. word) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = word\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 8. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 9. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 10. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and ?R1353 ntfnPtr tcb ntfn x and ko_at' ntfn ntfnptr) a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (9 subgoals):
 1. \<And>s ntfn word \<sigma> x ko' t notification val old ptr ptr' next. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 2. \<And>s ntfn word \<sigma> x ko' t notification v. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 3. \<And>s ntfn word \<sigma> x ko' t notification v v'. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 4. \<And>s ntfn word \<sigma> x ko' t notification. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P1427 s ntfn word \<sigma> x ko' t notification) ntfnptr \<sigma>
 5. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> \<lbrace>?R1353 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn word\<rbrace> asUser thread (setRegister Notification_H.badgeRegister word) \<lbrace>\<lambda>a. invs' and ko_at' ntfn ntfnptr\<rbrace>
 6. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word) badge_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. word) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = word\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 7. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 8. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 9. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and ?R1353 ntfnPtr tcb ntfn x and ko_at' ntfn ntfnptr) a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (8 subgoals):
 1. \<And>s ntfn word \<sigma> x ko' t notification v. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 2. \<And>s ntfn word \<sigma> x ko' t notification v v'. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 3. \<And>s ntfn word \<sigma> x ko' t notification. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P1427 s ntfn word \<sigma> x ko' t notification) ntfnptr \<sigma>
 4. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> \<lbrace>?R1353 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn word\<rbrace> asUser thread (setRegister Notification_H.badgeRegister word) \<lbrace>\<lambda>a. invs' and ko_at' ntfn ntfnptr\<rbrace>
 5. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word) badge_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. word) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = word\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 6. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 7. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 8. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and ?R1353 ntfnPtr tcb ntfn x and ko_at' ntfn ntfnptr) a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (7 subgoals):
 1. \<And>s ntfn word \<sigma> x ko' t notification v v'. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 2. \<And>s ntfn word \<sigma> x ko' t notification. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P1427 s ntfn word \<sigma> x ko' t notification) ntfnptr \<sigma>
 3. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> \<lbrace>?R1353 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn word\<rbrace> asUser thread (setRegister Notification_H.badgeRegister word) \<lbrace>\<lambda>a. invs' and ko_at' ntfn ntfnptr\<rbrace>
 4. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word) badge_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. word) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = word\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 5. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 6. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 7. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and ?R1353 ntfnPtr tcb ntfn x and ko_at' ntfn ntfnptr) a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (6 subgoals):
 1. \<And>s ntfn word \<sigma> x ko' t notification. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word; invs' \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P1427 s ntfn word \<sigma> x ko' t notification) ntfnptr \<sigma>
 2. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> \<lbrace>?R1353 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn word\<rbrace> asUser thread (setRegister Notification_H.badgeRegister word) \<lbrace>\<lambda>a. invs' and ko_at' ntfn ntfnptr\<rbrace>
 3. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word) badge_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. word) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = word\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 4. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 5. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 6. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and ?R1353 ntfnPtr tcb ntfn x and ko_at' ntfn ntfnptr) a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (5 subgoals):
 1. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> \<lbrace>?R1353 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn word\<rbrace> asUser thread (setRegister Notification_H.badgeRegister word) \<lbrace>\<lambda>a. invs' and ko_at' ntfn ntfnptr\<rbrace>
 2. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word) badge_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. word) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = word\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 3. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 4. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 5. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and ?R1353 ntfnPtr tcb ntfn x and ko_at' ntfn ntfnptr) a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (4 subgoals):
 1. \<And>s ntfn word. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn word\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word) badge_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. word) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = word\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 2. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 4. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn ntfnptr a) and ko_at' ntfn ntfnptr) a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (3 subgoals):
 1. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) (haskell_fail []) (\<acute>ret__int :== (if (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 2. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 3. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn ntfnptr a) and ko_at' ntfn ntfnptr) a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (3 subgoals):
 1. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R972 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn a x3) (?R''964 s ntfn x3) (SKIP # hs) fail (\<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 2. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> ?R''964 s ntfn x}}))
 3. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn ntfnptr a) and ko_at' ntfn ntfnptr) a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R972 ntfnPtr tcb ntfn a x)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (3 subgoals):
 1. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1496 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn x3) (?G'1497 s ntfn x3) (SKIP # hs) fail (IF 0 \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr ntfnptr);;
\<acute>badge :== \<acute>ret__unsigned;;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,\<acute>badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
ELSE
  Guard DontReach {} SKIP
FI)
 2. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := 0\<rparr> \<in> ?G'1497 s ntfn x}}}))
 3. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn ntfnptr a) and ko_at' ntfn ntfnptr) a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R1496 ntfnPtr tcb ntfn x a)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (3 subgoals):
 1. \<And>s ntfn x3. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1496 (ntfn_Ptr ntfnptr) (tcb_ptr_to_ctcb_ptr thread) ntfn x3) (?R'1623 s ntfn x3) (SKIP # hs) fail (Guard DontReach {} SKIP)
 2. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {sa. \<forall>x. sa \<in> {sa. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := 0\<rparr> \<in> ?R'1623 s ntfn x \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}}}))
 3. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn ntfnptr a) and ko_at' ntfn ntfnptr) a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R1496 ntfnPtr tcb ntfn x a)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (2 subgoals):
 1. \<And>s ntfn. \<lbrakk>invs' s; tcb_at' thread s; tcb_ptr_to_ctcb_ptr thread \<noteq> NULL\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> UNIV \<inter> - \<lbrace>0 \<noteq> 0\<rbrace>}}}))
 2. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn ntfnptr a) and ko_at' ntfn ntfnptr) a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> True)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal (1 subgoal):
 1. \<And>ntfnPtr tcb s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; tcb = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>ntfn. ko_at' ntfn ntfnptr a \<longrightarrow> ((\<lambda>a. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn ntfnptr a) and ko_at' ntfn ntfnptr) a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> True)) and ko_at' ntfn ntfnptr) a) and (invs' and tcb_at' thread)) s \<and> s' \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn ntfnptr s \<longrightarrow> s' \<in> UNIV}} proof (prove)
goal:
No subgoals!