theory Ipc_R

lemma sendSignal_corres:
  "corres dc (einvs and ntfn_at ep) (invs' and ntfn_at' ep)
             (send_signal ep bg) (sendSignal ep bg)" apply (simp add: send_signal_def sendSignal_def Let_def) apply (rule corres_guard_imp) apply (rule corres_split[OF getNotification_corres,
                where
                R  = "\<lambda>rv. einvs and ntfn_at ep and valid_ntfn rv and
                           ko_at (Structures_A.Notification rv) ep" and
                R' = "\<lambda>rv'. invs' and ntfn_at' ep and
                            valid_ntfn' rv' and ko_at' rv' ep"]) defer apply (wp get_simple_ko_ko_at get_ntfn_ko')+ apply (simp add: invs_valid_objs)+ apply (case_tac "ntfn_obj ntfn")
    \<comment> \<open>IdleNtfn\<close> apply (clarsimp simp add: ntfn_relation_def) apply (case_tac "ntfnBoundTCB nTFN") apply clarsimp apply (rule corres_guard_imp[OF setNotification_corres]) apply (clarsimp simp add: ntfn_relation_def)+ apply (rule corres_guard_imp) apply (rule corres_split[OF getThreadState_corres]) apply (rule corres_if) apply (fastforce simp: receive_blocked_def receiveBlocked_def
                                 thread_state_relation_def
                          split: Structures_A.thread_state.splits
                                 Structures_H.thread_state.splits) apply (rule corres_split[OF cancel_ipc_corres]) apply (rule corres_split[OF setThreadState_corres]) apply (clarsimp simp: thread_state_relation_def) apply (simp add: badgeRegister_def badge_register_def) apply (rule corres_split[OF asUser_setRegister_corres]) apply (rule possibleSwitchTo_corres) apply wp apply (wp set_thread_state_runnable_weak_valid_sched_action sts_st_tcb_at'
                       sts_valid_queues sts_st_tcb' hoare_disjI2
                       cancel_ipc_cte_wp_at_not_reply_state
                  | strengthen invs_vobjs_strgs invs_psp_aligned_strg valid_sched_weak_strg
                  | simp add: valid_tcb_state_def)+ apply (rule_tac Q="\<lambda>rv. invs' and tcb_at' a" in hoare_strengthen_post) apply wp apply (clarsimp simp: invs'_def valid_state'_def sch_act_wf_weak
                               valid_tcb_state'_def) apply (rule setNotification_corres) apply (clarsimp simp add: ntfn_relation_def) apply (wp gts_wp gts_wp' | clarsimp)+ apply (auto simp: valid_ntfn_def receive_blocked_def valid_sched_def invs_cur
                 elim: pred_tcb_weakenE
                intro: st_tcb_at_reply_cap_valid
                split: Structures_A.thread_state.splits)[1] apply (clarsimp simp: valid_ntfn'_def invs'_def valid_state'_def valid_pspace'_def sch_act_wf_weak)
   \<comment> \<open>WaitingNtfn\<close> apply (clarsimp simp add: ntfn_relation_def Let_def) apply (simp add: update_waiting_ntfn_def) apply (rename_tac list) apply (case_tac "tl list = []")
    \<comment> \<open>tl list = []\<close> apply (rule corres_guard_imp) apply (rule_tac F="list \<noteq> []" in corres_gen_asm) apply (simp add: list_case_helper split del: if_split) apply (rule corres_split[OF setNotification_corres]) apply (simp add: ntfn_relation_def) apply (rule corres_split[OF setThreadState_corres]) apply simp apply (simp add: badgeRegister_def badge_register_def) apply (rule corres_split[OF asUser_setRegister_corres]) apply (rule possibleSwitchTo_corres) apply ((wp | simp)+)[1] apply (rule_tac Q="\<lambda>_. Invariants_H.valid_queues and valid_queues' and
                                 (\<lambda>s. sch_act_wf (ksSchedulerAction s) s) and
                                 cur_tcb' and
                                 st_tcb_at' runnable' (hd list) and valid_objs'"
                   in hoare_post_imp, clarsimp simp: pred_tcb_at' elim!: sch_act_wf_weak) apply (wp | simp)+ apply (wp sts_st_tcb_at' set_thread_state_runnable_weak_valid_sched_action
              | simp)+ apply (wp sts_st_tcb_at'_cases sts_valid_queues setThreadState_valid_queues'
                  setThreadState_st_tcb
             | simp)+ apply (wp set_simple_ko_valid_objs set_ntfn_aligned' set_ntfn_valid_objs'
                hoare_vcg_disj_lift weak_sch_act_wf_lift_linear
           | simp add: valid_tcb_state_def valid_tcb_state'_def)+ apply (clarsimp simp: invs_def valid_state_def valid_ntfn_def
                           valid_pspace_def ntfn_queued_st_tcb_at valid_sched_def
                           valid_sched_action_def) apply (auto simp: valid_ntfn'_def )[1] apply (clarsimp simp: invs'_def valid_state'_def)

   \<comment> \<open>tl list \<noteq> []\<close> apply (rule corres_guard_imp) apply (rule_tac F="list \<noteq> []" in corres_gen_asm) apply (simp add: list_case_helper) apply (rule corres_split[OF setNotification_corres]) apply (simp add: ntfn_relation_def split:list.splits) apply (rule corres_split[OF setThreadState_corres]) apply simp apply (simp add: badgeRegister_def badge_register_def) apply (rule corres_split[OF asUser_setRegister_corres]) apply (rule possibleSwitchTo_corres) apply (wp cur_tcb_lift | simp)+ apply (wp sts_st_tcb_at' set_thread_state_runnable_weak_valid_sched_action
             | simp)+ apply (wp sts_st_tcb_at'_cases sts_valid_queues setThreadState_valid_queues'
                 setThreadState_st_tcb
            | simp)+ apply (wp set_ntfn_aligned' set_simple_ko_valid_objs set_ntfn_valid_objs'
               hoare_vcg_disj_lift weak_sch_act_wf_lift_linear
          | simp add: valid_tcb_state_def valid_tcb_state'_def)+ apply (clarsimp simp: invs_def valid_state_def valid_ntfn_def
                          valid_pspace_def neq_Nil_conv
                          ntfn_queued_st_tcb_at valid_sched_def valid_sched_action_def
                  split: option.splits) apply (auto simp: valid_ntfn'_def neq_Nil_conv invs'_def valid_state'_def
                     weak_sch_act_wf_def
              split: option.splits)[1]
  \<comment> \<open>ActiveNtfn\<close> apply (clarsimp simp add: ntfn_relation_def) apply (rule corres_guard_imp) apply (rule setNotification_corres) apply (simp add: ntfn_relation_def combine_ntfn_badges_def
                     combine_ntfn_msgs_def) apply (simp add: invs_def valid_state_def valid_ntfn_def) apply (simp add: invs'_def valid_state'_def valid_ntfn'_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. corres dc (einvs and ntfn_at ep) (invs' and ntfn_at' ep) (send_signal ep bg) (sendSignal ep bg) proof (prove)
goal (1 subgoal):
 1. corres dc (einvs and ntfn_at ep) (invs' and ntfn_at' ep) (do ntfn <- get_notification ep;
case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')
od) (do nTFN <- getNotification ep;
case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od
od) proof (prove)
goal (3 subgoals):
 1. corres dc ?Q ?Q' (do ntfn <- get_notification ep;
case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')
od) (do nTFN <- getNotification ep;
case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od
od)
 2. \<And>s. (einvs and ntfn_at ep) s \<Longrightarrow> ?Q s
 3. \<And>s. (invs' and ntfn_at' ep) s \<Longrightarrow> ?Q' s proof (prove)
goal (5 subgoals):
 1. \<And>ntfn nTFN. ntfn_relation ntfn nTFN \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 2. \<lbrace>?Q4\<rbrace> get_notification ep \<lbrace>\<lambda>ntfn. einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep\<rbrace>
 3. \<lbrace>?Q'4\<rbrace> getNotification ep \<lbrace>\<lambda>nTFN. invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep\<rbrace>
 4. \<And>s. (einvs and ntfn_at ep) s \<Longrightarrow> (ntfn_at ep and ?Q4) s
 5. \<And>s. (invs' and ntfn_at' ep) s \<Longrightarrow> (ntfn_at' ep and ?Q'4) s proof (prove)
goal (5 subgoals):
 1. \<lbrace>?Q4\<rbrace> get_notification ep \<lbrace>\<lambda>ntfn. einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep\<rbrace>
 2. \<lbrace>?Q'4\<rbrace> getNotification ep \<lbrace>\<lambda>nTFN. invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep\<rbrace>
 3. \<And>s. (einvs and ntfn_at ep) s \<Longrightarrow> (ntfn_at ep and ?Q4) s
 4. \<And>s. (invs' and ntfn_at' ep) s \<Longrightarrow> (ntfn_at' ep and ?Q'4) s
 5. \<And>ntfn nTFN. ntfn_relation ntfn nTFN \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (3 subgoals):
 1. \<And>s. (einvs and ntfn_at ep) s \<Longrightarrow> (ntfn_at ep and (\<lambda>s. (einvs and ntfn_at ep) s \<and> (valid_objs and ntfn_at ep) s \<and> True)) s
 2. \<And>s. (invs' and ntfn_at' ep) s \<Longrightarrow> (ntfn_at' ep and (\<lambda>s. (invs' and ntfn_at' ep) s \<and> (invs' and ntfn_at' ep) s \<and> True)) s
 3. \<And>ntfn nTFN. ntfn_relation ntfn nTFN \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (1 subgoal):
 1. \<And>ntfn nTFN. ntfn_relation ntfn nTFN \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (3 subgoals):
 1. \<And>ntfn nTFN. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 2. \<And>ntfn nTFN x2. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn x2\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 3. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (3 subgoals):
 1. \<And>ntfn nTFN. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfnBoundTCB nTFN of None \<Rightarrow> set_notification ep (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do y <- cancel_ipc tcb;
y <- set_thread_state tcb Structures_A.thread_state.Running;
y <- as_user tcb (setRegister badge_register bg);
possible_switch_to tcb
od else set_notification ep (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg))
od) (case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN) | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do y <- cancelIPC tcb;
y <- setThreadState Structures_H.thread_state.Running tcb;
y <- asUser tcb (setRegister Notification_H.badgeRegister bg);
possibleSwitchTo tcb
od else setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN)
od)
 2. \<And>ntfn nTFN x2. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn x2\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 3. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (4 subgoals):
 1. \<And>ntfn nTFN. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; ntfnBoundTCB nTFN = None\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfnBoundTCB nTFN of None \<Rightarrow> set_notification ep (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do y <- cancel_ipc tcb;
y <- set_thread_state tcb Structures_A.thread_state.Running;
y <- as_user tcb (setRegister badge_register bg);
possible_switch_to tcb
od else set_notification ep (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg))
od) (case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN) | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do y <- cancelIPC tcb;
y <- setThreadState Structures_H.thread_state.Running tcb;
y <- asUser tcb (setRegister Notification_H.badgeRegister bg);
possibleSwitchTo tcb
od else setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN)
od)
 2. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfnBoundTCB nTFN of None \<Rightarrow> set_notification ep (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do y <- cancel_ipc tcb;
y <- set_thread_state tcb Structures_A.thread_state.Running;
y <- as_user tcb (setRegister badge_register bg);
possible_switch_to tcb
od else set_notification ep (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg))
od) (case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN) | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do y <- cancelIPC tcb;
y <- setThreadState Structures_H.thread_state.Running tcb;
y <- asUser tcb (setRegister Notification_H.badgeRegister bg);
possibleSwitchTo tcb
od else setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN)
od)
 3. \<And>ntfn nTFN x2. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn x2\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 4. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (4 subgoals):
 1. \<And>ntfn nTFN. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = None; ntfnBoundTCB nTFN = None\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (set_notification ep (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg))) (setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN))
 2. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfnBoundTCB nTFN of None \<Rightarrow> set_notification ep (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do y <- cancel_ipc tcb;
y <- set_thread_state tcb Structures_A.thread_state.Running;
y <- as_user tcb (setRegister badge_register bg);
possible_switch_to tcb
od else set_notification ep (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg))
od) (case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN) | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do y <- cancelIPC tcb;
y <- setThreadState Structures_H.thread_state.Running tcb;
y <- asUser tcb (setRegister Notification_H.badgeRegister bg);
possibleSwitchTo tcb
od else setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN)
od)
 3. \<And>ntfn nTFN x2. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn x2\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 4. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (6 subgoals):
 1. \<And>ntfn nTFN. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = None; ntfnBoundTCB nTFN = None\<rbrakk> \<Longrightarrow> ntfn_relation (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN)
 2. \<And>ntfn nTFN s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = None; ntfnBoundTCB nTFN = None; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> ntfn_at ep s
 3. \<And>ntfn nTFN s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = None; ntfnBoundTCB nTFN = None; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> ntfn_at' ep s
 4. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfnBoundTCB nTFN of None \<Rightarrow> set_notification ep (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do y <- cancel_ipc tcb;
y <- set_thread_state tcb Structures_A.thread_state.Running;
y <- as_user tcb (setRegister badge_register bg);
possible_switch_to tcb
od else set_notification ep (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg))
od) (case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN) | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do y <- cancelIPC tcb;
y <- setThreadState Structures_H.thread_state.Running tcb;
y <- asUser tcb (setRegister Notification_H.badgeRegister bg);
possibleSwitchTo tcb
od else setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN)
od)
 5. \<And>ntfn nTFN x2. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn x2\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 6. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (3 subgoals):
 1. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (do st <- get_thread_state a;
if receive_blocked st then do y <- cancel_ipc a;
y <- set_thread_state a Structures_A.thread_state.Running;
y <- as_user a (setRegister badge_register bg);
possible_switch_to a
od else set_notification ep (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg))
od) (do state <- getThreadState a;
if receiveBlocked state then do y <- cancelIPC a;
y <- setThreadState Structures_H.thread_state.Running a;
y <- asUser a (setRegister Notification_H.badgeRegister bg);
possibleSwitchTo a
od else setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN)
od)
 2. \<And>ntfn nTFN x2. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn x2\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 3. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (5 subgoals):
 1. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> corres dc (?Q41 ntfn nTFN a) (?Q'41 ntfn nTFN a) (do st <- get_thread_state a;
if receive_blocked st then do y <- cancel_ipc a;
y <- set_thread_state a Structures_A.thread_state.Running;
y <- as_user a (setRegister badge_register bg);
possible_switch_to a
od else set_notification ep (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg))
od) (do state <- getThreadState a;
if receiveBlocked state then do y <- cancelIPC a;
y <- setThreadState Structures_H.thread_state.Running a;
y <- asUser a (setRegister Notification_H.badgeRegister bg);
possibleSwitchTo a
od else setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN)
od)
 2. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> ?Q41 ntfn nTFN a s
 3. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> ?Q'41 ntfn nTFN a s
 4. \<And>ntfn nTFN x2. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn x2\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 5. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (7 subgoals):
 1. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> corres dc (?R45 ntfn nTFN a st) (?R'45 ntfn nTFN a state) (if receive_blocked st then do y <- cancel_ipc a;
y <- set_thread_state a Structures_A.thread_state.Running;
y <- as_user a (setRegister badge_register bg);
possible_switch_to a
od else set_notification ep (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg))) (if receiveBlocked state then do y <- cancelIPC a;
y <- setThreadState Structures_H.thread_state.Running a;
y <- asUser a (setRegister Notification_H.badgeRegister bg);
possibleSwitchTo a
od else setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN))
 2. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q45 ntfn nTFN a\<rbrace> get_thread_state a \<lbrace>?R45 ntfn nTFN a\<rbrace>
 3. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'45 ntfn nTFN a\<rbrace> getThreadState a \<lbrace>?R'45 ntfn nTFN a\<rbrace>
 4. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (tcb_at a and ?Q45 ntfn nTFN a) s
 5. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (tcb_at' a and ?Q'45 ntfn nTFN a) s
 6. \<And>ntfn nTFN x2. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn x2\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 7. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (9 subgoals):
 1. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> receive_blocked st = receiveBlocked state
 2. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> corres dc (?P52 ntfn nTFN a st) (?P'55 ntfn nTFN a state) (do y <- cancel_ipc a;
y <- set_thread_state a Structures_A.thread_state.Running;
y <- as_user a (setRegister badge_register bg);
possible_switch_to a
od) (do y <- cancelIPC a;
y <- setThreadState Structures_H.thread_state.Running a;
y <- asUser a (setRegister Notification_H.badgeRegister bg);
possibleSwitchTo a
od)
 3. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> corres dc (?Q53 ntfn nTFN a st) (?Q'56 ntfn nTFN a state) (set_notification ep (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg))) (setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN))
 4. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q45 ntfn nTFN a\<rbrace> get_thread_state a \<lbrace>\<lambda>st. if receive_blocked st then ?P52 ntfn nTFN a st else ?Q53 ntfn nTFN a st\<rbrace>
 5. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'45 ntfn nTFN a\<rbrace> getThreadState a \<lbrace>\<lambda>state. if receiveBlocked state then ?P'55 ntfn nTFN a state else ?Q'56 ntfn nTFN a state\<rbrace>
 6. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (tcb_at a and ?Q45 ntfn nTFN a) s
 7. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (tcb_at' a and ?Q'45 ntfn nTFN a) s
 8. \<And>ntfn nTFN x2. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn x2\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 9. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (8 subgoals):
 1. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> corres dc (?P52 ntfn nTFN a st) (?P'55 ntfn nTFN a state) (do y <- cancel_ipc a;
y <- set_thread_state a Structures_A.thread_state.Running;
y <- as_user a (setRegister badge_register bg);
possible_switch_to a
od) (do y <- cancelIPC a;
y <- setThreadState Structures_H.thread_state.Running a;
y <- asUser a (setRegister Notification_H.badgeRegister bg);
possibleSwitchTo a
od)
 2. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> corres dc (?Q53 ntfn nTFN a st) (?Q'56 ntfn nTFN a state) (set_notification ep (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg))) (setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN))
 3. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q45 ntfn nTFN a\<rbrace> get_thread_state a \<lbrace>\<lambda>st. if receive_blocked st then ?P52 ntfn nTFN a st else ?Q53 ntfn nTFN a st\<rbrace>
 4. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'45 ntfn nTFN a\<rbrace> getThreadState a \<lbrace>\<lambda>state. if receiveBlocked state then ?P'55 ntfn nTFN a state else ?Q'56 ntfn nTFN a state\<rbrace>
 5. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (tcb_at a and ?Q45 ntfn nTFN a) s
 6. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (tcb_at' a and ?Q'45 ntfn nTFN a) s
 7. \<And>ntfn nTFN x2. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn x2\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 8. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (10 subgoals):
 1. \<And>ntfn nTFN a st state y ya. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R162 ntfn nTFN a st state y) (?R'162 ntfn nTFN a st state ya) (do y <- set_thread_state a Structures_A.thread_state.Running;
y <- as_user a (setRegister badge_register bg);
possible_switch_to a
od) (do y <- setThreadState Structures_H.thread_state.Running a;
y <- asUser a (setRegister Notification_H.badgeRegister bg);
possibleSwitchTo a
od)
 2. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> \<lbrace>?Q165 ntfn nTFN a st\<rbrace> cancel_ipc a \<lbrace>?R162 ntfn nTFN a st state\<rbrace>
 3. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> \<lbrace>?Q'167 ntfn nTFN a state\<rbrace> cancelIPC a \<lbrace>?R'162 ntfn nTFN a st state\<rbrace>
 4. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> corres dc (?Q53 ntfn nTFN a st) (?Q'56 ntfn nTFN a state) (set_notification ep (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg))) (setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN))
 5. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q45 ntfn nTFN a\<rbrace> get_thread_state a \<lbrace>\<lambda>st. if receive_blocked st then einvs and tcb_at a and ?Q165 ntfn nTFN a st else ?Q53 ntfn nTFN a st\<rbrace>
 6. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'45 ntfn nTFN a\<rbrace> getThreadState a \<lbrace>\<lambda>state. if receiveBlocked state then invs' and tcb_at' a and ?Q'167 ntfn nTFN a state else ?Q'56 ntfn nTFN a state\<rbrace>
 7. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (tcb_at a and ?Q45 ntfn nTFN a) s
 8. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (tcb_at' a and ?Q'45 ntfn nTFN a) s
 9. \<And>ntfn nTFN x2. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn x2\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 10. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (13 subgoals):
 1. \<And>ntfn nTFN a st state y ya. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state; dc y ya\<rbrakk> \<Longrightarrow> thread_state_relation Structures_A.thread_state.Running Structures_H.thread_state.Running
 2. \<And>ntfn nTFN a st state y ya yb yc. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state; dc y ya; dc yb yc\<rbrakk> \<Longrightarrow> corres dc (?R171 ntfn nTFN a st state y ya yb) (?R'171 ntfn nTFN a st state y ya yc) (do y <- as_user a (setRegister badge_register bg);
possible_switch_to a
od) (do y <- asUser a (setRegister Notification_H.badgeRegister bg);
possibleSwitchTo a
od)
 3. \<And>ntfn nTFN a st state y ya. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 ntfn nTFN a st state y\<rbrace> set_thread_state a Structures_A.thread_state.Running \<lbrace>?R171 ntfn nTFN a st state y ya\<rbrace>
 4. \<And>ntfn nTFN a st state y ya. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'176 ntfn nTFN a st state ya\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>?R'171 ntfn nTFN a st state y ya\<rbrace>
 5. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> \<lbrace>?Q165 ntfn nTFN a st\<rbrace> cancel_ipc a \<lbrace>\<lambda>y. tcb_at a and ?Q174 ntfn nTFN a st state y\<rbrace>
 6. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> \<lbrace>?Q'167 ntfn nTFN a state\<rbrace> cancelIPC a \<lbrace>\<lambda>ya. tcb_at' a and ?Q'176 ntfn nTFN a st state ya\<rbrace>
 7. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> corres dc (?Q53 ntfn nTFN a st) (?Q'56 ntfn nTFN a state) (set_notification ep (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg))) (setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN))
 8. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q45 ntfn nTFN a\<rbrace> get_thread_state a \<lbrace>\<lambda>st. if receive_blocked st then einvs and tcb_at a and ?Q165 ntfn nTFN a st else ?Q53 ntfn nTFN a st\<rbrace>
 9. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'45 ntfn nTFN a\<rbrace> getThreadState a \<lbrace>\<lambda>state. if receiveBlocked state then invs' and tcb_at' a and ?Q'167 ntfn nTFN a state else ?Q'56 ntfn nTFN a state\<rbrace>
 10. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (tcb_at a and ?Q45 ntfn nTFN a) s
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>ntfn nTFN a st state y ya yb yc. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state; dc y ya; dc yb yc\<rbrakk> \<Longrightarrow> corres dc (?R171 ntfn nTFN a st state y ya yb) (?R'171 ntfn nTFN a st state y ya yc) (do y <- as_user a (setRegister badge_register bg);
possible_switch_to a
od) (do y <- asUser a (setRegister Notification_H.badgeRegister bg);
possibleSwitchTo a
od)
 2. \<And>ntfn nTFN a st state y ya. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 ntfn nTFN a st state y\<rbrace> set_thread_state a Structures_A.thread_state.Running \<lbrace>?R171 ntfn nTFN a st state y ya\<rbrace>
 3. \<And>ntfn nTFN a st state y ya. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'176 ntfn nTFN a st state ya\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>?R'171 ntfn nTFN a st state y ya\<rbrace>
 4. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> \<lbrace>?Q165 ntfn nTFN a st\<rbrace> cancel_ipc a \<lbrace>\<lambda>y. tcb_at a and ?Q174 ntfn nTFN a st state y\<rbrace>
 5. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> \<lbrace>?Q'167 ntfn nTFN a state\<rbrace> cancelIPC a \<lbrace>\<lambda>ya. tcb_at' a and ?Q'176 ntfn nTFN a st state ya\<rbrace>
 6. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> corres dc (?Q53 ntfn nTFN a st) (?Q'56 ntfn nTFN a state) (set_notification ep (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg))) (setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN))
 7. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q45 ntfn nTFN a\<rbrace> get_thread_state a \<lbrace>\<lambda>st. if receive_blocked st then einvs and tcb_at a and ?Q165 ntfn nTFN a st else ?Q53 ntfn nTFN a st\<rbrace>
 8. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'45 ntfn nTFN a\<rbrace> getThreadState a \<lbrace>\<lambda>state. if receiveBlocked state then invs' and tcb_at' a and ?Q'167 ntfn nTFN a state else ?Q'56 ntfn nTFN a state\<rbrace>
 9. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (tcb_at a and ?Q45 ntfn nTFN a) s
 10. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (tcb_at' a and ?Q'45 ntfn nTFN a) s
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> corres dc (?R171 ntfn nTFN a st state () () ()) (?R'171 ntfn nTFN a st state () () ()) (do y <- as_user a (setRegister ARM.badgeRegister bg);
possible_switch_to a
od) (do y <- asUser a (setRegister ARM.badgeRegister bg);
possibleSwitchTo a
od)
 2. \<And>ntfn nTFN a st state y ya. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 ntfn nTFN a st state y\<rbrace> set_thread_state a Structures_A.thread_state.Running \<lbrace>?R171 ntfn nTFN a st state y ya\<rbrace>
 3. \<And>ntfn nTFN a st state y ya. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'176 ntfn nTFN a st state ya\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>?R'171 ntfn nTFN a st state y ya\<rbrace>
 4. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> \<lbrace>?Q165 ntfn nTFN a st\<rbrace> cancel_ipc a \<lbrace>\<lambda>y. tcb_at a and ?Q174 ntfn nTFN a st state y\<rbrace>
 5. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> \<lbrace>?Q'167 ntfn nTFN a state\<rbrace> cancelIPC a \<lbrace>\<lambda>ya. tcb_at' a and ?Q'176 ntfn nTFN a st state ya\<rbrace>
 6. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> corres dc (?Q53 ntfn nTFN a st) (?Q'56 ntfn nTFN a state) (set_notification ep (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg))) (setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN))
 7. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q45 ntfn nTFN a\<rbrace> get_thread_state a \<lbrace>\<lambda>st. if receive_blocked st then einvs and tcb_at a and ?Q165 ntfn nTFN a st else ?Q53 ntfn nTFN a st\<rbrace>
 8. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'45 ntfn nTFN a\<rbrace> getThreadState a \<lbrace>\<lambda>state. if receiveBlocked state then invs' and tcb_at' a and ?Q'167 ntfn nTFN a state else ?Q'56 ntfn nTFN a state\<rbrace>
 9. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (tcb_at a and ?Q45 ntfn nTFN a) s
 10. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (tcb_at' a and ?Q'45 ntfn nTFN a) s
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>ntfn nTFN a st state y ya. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R181 ntfn nTFN a st state y) (?R'181 ntfn nTFN a st state ya) (possible_switch_to a) (possibleSwitchTo a)
 2. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> \<lbrace>?Q186 ntfn nTFN a st state () () ()\<rbrace> as_user a (setRegister ARM.badgeRegister bg) \<lbrace>?R181 ntfn nTFN a st state\<rbrace>
 3. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 ntfn nTFN a st state () () ()\<rbrace> asUser a (setRegister ARM.badgeRegister bg) \<lbrace>?R'181 ntfn nTFN a st state\<rbrace>
 4. \<And>ntfn nTFN a st state y ya. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 ntfn nTFN a st state y\<rbrace> set_thread_state a Structures_A.thread_state.Running \<lbrace>\<lambda>b. tcb_at a and ?Q186 ntfn nTFN a st state y ya b\<rbrace>
 5. \<And>ntfn nTFN a st state y ya. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'176 ntfn nTFN a st state ya\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>\<lambda>b. tcb_at' a and ?Q'185 ntfn nTFN a st state y ya b\<rbrace>
 6. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> \<lbrace>?Q165 ntfn nTFN a st\<rbrace> cancel_ipc a \<lbrace>\<lambda>y. tcb_at a and ?Q174 ntfn nTFN a st state y\<rbrace>
 7. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> \<lbrace>?Q'167 ntfn nTFN a state\<rbrace> cancelIPC a \<lbrace>\<lambda>ya. tcb_at' a and ?Q'176 ntfn nTFN a st state ya\<rbrace>
 8. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> corres dc (?Q53 ntfn nTFN a st) (?Q'56 ntfn nTFN a state) (set_notification ep (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg))) (setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN))
 9. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q45 ntfn nTFN a\<rbrace> get_thread_state a \<lbrace>\<lambda>st. if receive_blocked st then einvs and tcb_at a and ?Q165 ntfn nTFN a st else ?Q53 ntfn nTFN a st\<rbrace>
 10. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'45 ntfn nTFN a\<rbrace> getThreadState a \<lbrace>\<lambda>state. if receiveBlocked state then invs' and tcb_at' a and ?Q'167 ntfn nTFN a state else ?Q'56 ntfn nTFN a state\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> \<lbrace>?Q186 ntfn nTFN a st state () () ()\<rbrace> as_user a (setRegister ARM.badgeRegister bg) \<lbrace>\<lambda>y. valid_etcbs and weak_valid_sched_action and cur_tcb and st_tcb_at runnable a\<rbrace>
 2. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 ntfn nTFN a st state () () ()\<rbrace> asUser a (setRegister ARM.badgeRegister bg) \<lbrace>\<lambda>ya. Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and cur_tcb' and tcb_at' a and st_tcb_at' runnable' a and valid_objs'\<rbrace>
 3. \<And>ntfn nTFN a st state y ya. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 ntfn nTFN a st state y\<rbrace> set_thread_state a Structures_A.thread_state.Running \<lbrace>\<lambda>b. tcb_at a and ?Q186 ntfn nTFN a st state y ya b\<rbrace>
 4. \<And>ntfn nTFN a st state y ya. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'176 ntfn nTFN a st state ya\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>\<lambda>b. tcb_at' a and ?Q'185 ntfn nTFN a st state y ya b\<rbrace>
 5. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> \<lbrace>?Q165 ntfn nTFN a st\<rbrace> cancel_ipc a \<lbrace>\<lambda>y. tcb_at a and ?Q174 ntfn nTFN a st state y\<rbrace>
 6. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> \<lbrace>?Q'167 ntfn nTFN a state\<rbrace> cancelIPC a \<lbrace>\<lambda>ya. tcb_at' a and ?Q'176 ntfn nTFN a st state ya\<rbrace>
 7. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> corres dc (?Q53 ntfn nTFN a st) (?Q'56 ntfn nTFN a state) (set_notification ep (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg))) (setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN))
 8. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q45 ntfn nTFN a\<rbrace> get_thread_state a \<lbrace>\<lambda>st. if receive_blocked st then einvs and tcb_at a and ?Q165 ntfn nTFN a st else ?Q53 ntfn nTFN a st\<rbrace>
 9. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'45 ntfn nTFN a\<rbrace> getThreadState a \<lbrace>\<lambda>state. if receiveBlocked state then invs' and tcb_at' a and ?Q'167 ntfn nTFN a state else ?Q'56 ntfn nTFN a state\<rbrace>
 10. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (tcb_at a and ?Q45 ntfn nTFN a) s
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 ntfn nTFN a st state () () ()\<rbrace> asUser a (setRegister ARM.badgeRegister bg) \<lbrace>\<lambda>ya. Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and cur_tcb' and tcb_at' a and st_tcb_at' runnable' a and valid_objs'\<rbrace>
 2. \<And>ntfn nTFN a st state y ya. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 ntfn nTFN a st state y\<rbrace> set_thread_state a Structures_A.thread_state.Running \<lbrace>\<lambda>b. tcb_at a and (\<lambda>b. valid_etcbs b \<and> weak_valid_sched_action b \<and> cur_tcb b \<and> st_tcb_at runnable a b)\<rbrace>
 3. \<And>ntfn nTFN a st state y ya. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'176 ntfn nTFN a st state ya\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>\<lambda>b. tcb_at' a and ?Q'185 ntfn nTFN a st state y ya b\<rbrace>
 4. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> \<lbrace>?Q165 ntfn nTFN a st\<rbrace> cancel_ipc a \<lbrace>\<lambda>y. tcb_at a and ?Q174 ntfn nTFN a st state y\<rbrace>
 5. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> \<lbrace>?Q'167 ntfn nTFN a state\<rbrace> cancelIPC a \<lbrace>\<lambda>ya. tcb_at' a and ?Q'176 ntfn nTFN a st state ya\<rbrace>
 6. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> corres dc (?Q53 ntfn nTFN a st) (?Q'56 ntfn nTFN a state) (set_notification ep (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg))) (setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN))
 7. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q45 ntfn nTFN a\<rbrace> get_thread_state a \<lbrace>\<lambda>st. if receive_blocked st then einvs and tcb_at a and ?Q165 ntfn nTFN a st else ?Q53 ntfn nTFN a st\<rbrace>
 8. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'45 ntfn nTFN a\<rbrace> getThreadState a \<lbrace>\<lambda>state. if receiveBlocked state then invs' and tcb_at' a and ?Q'167 ntfn nTFN a state else ?Q'56 ntfn nTFN a state\<rbrace>
 9. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (tcb_at a and ?Q45 ntfn nTFN a) s
 10. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (tcb_at' a and ?Q'45 ntfn nTFN a) s
A total of 12 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> \<lbrace>?P'380 ntfn nTFN a state\<rbrace> cancelIPC a \<lbrace>\<lambda>rv s. weak_sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' a s \<and> valid_tcb_state' Structures_H.thread_state.Running s \<and> valid_objs' s\<rbrace>
 2. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> corres dc (?Q53 ntfn nTFN a st) (?Q'56 ntfn nTFN a state) (set_notification ep (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg))) (setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN))
 3. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q45 ntfn nTFN a\<rbrace> get_thread_state a \<lbrace>\<lambda>st. if receive_blocked st then einvs and tcb_at a and (\<lambda>s. tcb_at a s \<and> tcb_at a s \<and> valid_etcbs s \<and> valid_sched s \<and> runnable Structures_A.thread_state.Running \<and> cur_tcb s \<and> K (runnable Structures_A.thread_state.Running) s) else ?Q53 ntfn nTFN a st\<rbrace>
 4. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'45 ntfn nTFN a\<rbrace> getThreadState a \<lbrace>\<lambda>state. if receiveBlocked state then invs' and tcb_at' a and (\<lambda>s. tcb_at' a s \<and> tcb_at' a s \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s \<and> (valid_queues' and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s)) s \<and> ?P'380 ntfn nTFN a state s) else ?Q'56 ntfn nTFN a state\<rbrace>
 5. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (tcb_at a and ?Q45 ntfn nTFN a) s
 6. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (tcb_at' a and ?Q'45 ntfn nTFN a) s
 7. \<And>ntfn nTFN x2. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn x2\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 8. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (9 subgoals):
 1. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> \<lbrace>?P'380 ntfn nTFN a state\<rbrace> cancelIPC a \<lbrace>\<lambda>rv. invs' and tcb_at' a\<rbrace>
 2. \<And>ntfn nTFN a st state rv s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state; (invs' and tcb_at' a) s\<rbrakk> \<Longrightarrow> weak_sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' a s \<and> valid_tcb_state' Structures_H.thread_state.Running s \<and> valid_objs' s
 3. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> corres dc (?Q53 ntfn nTFN a st) (?Q'56 ntfn nTFN a state) (set_notification ep (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg))) (setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN))
 4. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q45 ntfn nTFN a\<rbrace> get_thread_state a \<lbrace>\<lambda>st. if receive_blocked st then einvs and tcb_at a and (\<lambda>s. tcb_at a s \<and> tcb_at a s \<and> valid_etcbs s \<and> valid_sched s \<and> runnable Structures_A.thread_state.Running \<and> cur_tcb s \<and> K (runnable Structures_A.thread_state.Running) s) else ?Q53 ntfn nTFN a st\<rbrace>
 5. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'45 ntfn nTFN a\<rbrace> getThreadState a \<lbrace>\<lambda>state. if receiveBlocked state then invs' and tcb_at' a and (\<lambda>s. tcb_at' a s \<and> tcb_at' a s \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s \<and> (valid_queues' and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s)) s \<and> ?P'380 ntfn nTFN a state s) else ?Q'56 ntfn nTFN a state\<rbrace>
 6. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (tcb_at a and ?Q45 ntfn nTFN a) s
 7. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (tcb_at' a and ?Q'45 ntfn nTFN a) s
 8. \<And>ntfn nTFN x2. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn x2\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 9. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (8 subgoals):
 1. \<And>ntfn nTFN a st state rv s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state; (invs' and tcb_at' a) s\<rbrakk> \<Longrightarrow> weak_sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' a s \<and> valid_tcb_state' Structures_H.thread_state.Running s \<and> valid_objs' s
 2. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> corres dc (?Q53 ntfn nTFN a st) (?Q'56 ntfn nTFN a state) (set_notification ep (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg))) (setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN))
 3. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q45 ntfn nTFN a\<rbrace> get_thread_state a \<lbrace>\<lambda>st. if receive_blocked st then einvs and tcb_at a and (\<lambda>s. tcb_at a s \<and> tcb_at a s \<and> valid_etcbs s \<and> valid_sched s \<and> runnable Structures_A.thread_state.Running \<and> cur_tcb s \<and> K (runnable Structures_A.thread_state.Running) s) else ?Q53 ntfn nTFN a st\<rbrace>
 4. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'45 ntfn nTFN a\<rbrace> getThreadState a \<lbrace>\<lambda>state. if receiveBlocked state then invs' and tcb_at' a and (\<lambda>s. tcb_at' a s \<and> tcb_at' a s \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s \<and> (valid_queues' and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s)) s \<and> (tcb_at' a and invs') s \<and> tcb_at' a s) else ?Q'56 ntfn nTFN a state\<rbrace>
 5. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (tcb_at a and ?Q45 ntfn nTFN a) s
 6. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (tcb_at' a and ?Q'45 ntfn nTFN a) s
 7. \<And>ntfn nTFN x2. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn x2\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 8. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (7 subgoals):
 1. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> corres dc (?Q53 ntfn nTFN a st) (?Q'56 ntfn nTFN a state) (set_notification ep (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg))) (setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN))
 2. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q45 ntfn nTFN a\<rbrace> get_thread_state a \<lbrace>\<lambda>st. if receive_blocked st then einvs and tcb_at a and (\<lambda>s. tcb_at a s \<and> tcb_at a s \<and> valid_etcbs s \<and> valid_sched s \<and> runnable Structures_A.thread_state.Running \<and> cur_tcb s \<and> K (runnable Structures_A.thread_state.Running) s) else ?Q53 ntfn nTFN a st\<rbrace>
 3. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'45 ntfn nTFN a\<rbrace> getThreadState a \<lbrace>\<lambda>state. if receiveBlocked state then invs' and tcb_at' a and (\<lambda>s. tcb_at' a s \<and> tcb_at' a s \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s \<and> (valid_queues' and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s)) s \<and> (tcb_at' a and invs') s \<and> tcb_at' a s) else ?Q'56 ntfn nTFN a state\<rbrace>
 4. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (tcb_at a and ?Q45 ntfn nTFN a) s
 5. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (tcb_at' a and ?Q'45 ntfn nTFN a) s
 6. \<And>ntfn nTFN x2. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn x2\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 7. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (7 subgoals):
 1. \<And>ntfn nTFN a st state. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; thread_state_relation st state\<rbrakk> \<Longrightarrow> ntfn_relation (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN)
 2. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q45 ntfn nTFN a\<rbrace> get_thread_state a \<lbrace>\<lambda>st. if receive_blocked st then einvs and tcb_at a and (\<lambda>s. tcb_at a s \<and> tcb_at a s \<and> valid_etcbs s \<and> valid_sched s \<and> runnable Structures_A.thread_state.Running \<and> cur_tcb s \<and> K (runnable Structures_A.thread_state.Running) s) else ntfn_at ep\<rbrace>
 3. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'45 ntfn nTFN a\<rbrace> getThreadState a \<lbrace>\<lambda>state. if receiveBlocked state then invs' and tcb_at' a and (\<lambda>s. tcb_at' a s \<and> tcb_at' a s \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s \<and> (valid_queues' and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s)) s \<and> (tcb_at' a and invs') s \<and> tcb_at' a s) else ntfn_at' ep\<rbrace>
 4. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (tcb_at a and ?Q45 ntfn nTFN a) s
 5. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (tcb_at' a and ?Q'45 ntfn nTFN a) s
 6. \<And>ntfn nTFN x2. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn x2\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 7. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (6 subgoals):
 1. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q45 ntfn nTFN a\<rbrace> get_thread_state a \<lbrace>\<lambda>st. if receive_blocked st then einvs and tcb_at a and (\<lambda>s. tcb_at a s \<and> tcb_at a s \<and> valid_etcbs s \<and> valid_sched s \<and> runnable Structures_A.thread_state.Running \<and> cur_tcb s \<and> K (runnable Structures_A.thread_state.Running) s) else ntfn_at ep\<rbrace>
 2. \<And>ntfn nTFN a. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'45 ntfn nTFN a\<rbrace> getThreadState a \<lbrace>\<lambda>state. if receiveBlocked state then invs' and tcb_at' a and (\<lambda>s. tcb_at' a s \<and> tcb_at' a s \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s \<and> (valid_queues' and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s)) s \<and> (tcb_at' a and invs') s \<and> tcb_at' a s) else ntfn_at' ep\<rbrace>
 3. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (tcb_at a and ?Q45 ntfn nTFN a) s
 4. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (tcb_at' a and ?Q'45 ntfn nTFN a) s
 5. \<And>ntfn nTFN x2. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn x2\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 6. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (4 subgoals):
 1. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; invs s; valid_list s; valid_sched s; ntfn_at ep s; valid_ntfn ntfn s; ko_at (Notification ntfn) ep s\<rbrakk> \<Longrightarrow> tcb_at a s \<and> (\<forall>st. receive_blocked st \<longrightarrow> st_tcb_at ((=) st) a s \<longrightarrow> tcb_at a s \<and> valid_etcbs s \<and> cur_tcb s)
 2. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (tcb_at' a and (\<lambda>s. \<forall>st. st_tcb_at' ((=) st) a s \<longrightarrow> (if receiveBlocked st then invs' and tcb_at' a and (\<lambda>s. tcb_at' a s \<and> tcb_at' a s \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s \<and> (valid_queues' and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s)) s \<and> (tcb_at' a and invs') s \<and> tcb_at' a s) else ntfn_at' ep) s)) s
 3. \<And>ntfn nTFN x2. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn x2\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 4. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (3 subgoals):
 1. \<And>ntfn nTFN a s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.IdleNtfn; ntfnObj nTFN = Structures_H.ntfn.IdleNtfn; ntfn_bound_tcb ntfn = Some a; ntfnBoundTCB nTFN = Some a; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (tcb_at' a and (\<lambda>s. \<forall>st. st_tcb_at' ((=) st) a s \<longrightarrow> (if receiveBlocked st then invs' and tcb_at' a and (\<lambda>s. tcb_at' a s \<and> tcb_at' a s \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s \<and> (valid_queues' and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s)) s \<and> (tcb_at' a and invs') s \<and> tcb_at' a s) else ntfn_at' ep) s)) s
 2. \<And>ntfn nTFN x2. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn x2\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 3. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (2 subgoals):
 1. \<And>ntfn nTFN x2. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn x2\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 2. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (2 subgoals):
 1. \<And>ntfn nTFN x2. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn x2; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn x2; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (update_waiting_ntfn ep x2 (ntfnBoundTCB nTFN) bg) (case x2 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 2. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (2 subgoals):
 1. \<And>ntfn nTFN x2. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn x2; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn x2; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (do y <- assert (x2 \<noteq> []);
y <- set_notification ep \<lparr>ntfn_obj = case drop (Suc 0) x2 of [] \<Rightarrow> Structures_A.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_A.ntfn.WaitingNtfn (drop (Suc 0) x2), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr>;
y <- set_thread_state (hd x2) Structures_A.thread_state.Running;
y <- as_user (hd x2) (setRegister badge_register bg);
possible_switch_to (hd x2)
od) (case x2 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 2. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (2 subgoals):
 1. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (do y <- assert (list \<noteq> []);
y <- set_notification ep \<lparr>ntfn_obj = case drop (Suc 0) list of [] \<Rightarrow> Structures_A.ntfn.IdleNtfn | a # lista \<Rightarrow> Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr>;
y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 2. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (3 subgoals):
 1. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (do y <- assert (list \<noteq> []);
y <- set_notification ep \<lparr>ntfn_obj = case drop (Suc 0) list of [] \<Rightarrow> Structures_A.ntfn.IdleNtfn | a # lista \<Rightarrow> Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr>;
y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 2. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (do y <- assert (list \<noteq> []);
y <- set_notification ep \<lparr>ntfn_obj = case drop (Suc 0) list of [] \<Rightarrow> Structures_A.ntfn.IdleNtfn | a # lista \<Rightarrow> Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr>;
y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 3. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (5 subgoals):
 1. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []\<rbrakk> \<Longrightarrow> corres dc (?Q474 ntfn nTFN list) (?Q'474 ntfn nTFN list) (do y <- assert (list \<noteq> []);
y <- set_notification ep \<lparr>ntfn_obj = case drop (Suc 0) list of [] \<Rightarrow> Structures_A.ntfn.IdleNtfn | a # lista \<Rightarrow> Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr>;
y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 2. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> ?Q474 ntfn nTFN list s
 3. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> ?Q'474 ntfn nTFN list s
 4. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (do y <- assert (list \<noteq> []);
y <- set_notification ep \<lparr>ntfn_obj = case drop (Suc 0) list of [] \<Rightarrow> Structures_A.ntfn.IdleNtfn | a # lista \<Rightarrow> Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr>;
y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 5. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (5 subgoals):
 1. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (?P478 ntfn nTFN list) (?Q'474 ntfn nTFN list) (do y <- assert (list \<noteq> []);
y <- set_notification ep \<lparr>ntfn_obj = case drop (Suc 0) list of [] \<Rightarrow> Structures_A.ntfn.IdleNtfn | a # lista \<Rightarrow> Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr>;
y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 2. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (?P478 ntfn nTFN list and (\<lambda>s. list \<noteq> [])) s
 3. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> ?Q'474 ntfn nTFN list s
 4. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (do y <- assert (list \<noteq> []);
y <- set_notification ep \<lparr>ntfn_obj = case drop (Suc 0) list of [] \<Rightarrow> Structures_A.ntfn.IdleNtfn | a # lista \<Rightarrow> Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr>;
y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 5. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (5 subgoals):
 1. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (?P478 ntfn nTFN list) (?Q'474 ntfn nTFN list) (do y <- set_notification ep \<lparr>ntfn_obj = Structures_A.ntfn.IdleNtfn, ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr>;
y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (do y <- setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) nTFN);
y <- setThreadState Structures_H.thread_state.Running (hd list);
y <- asUser (hd list) (setRegister Notification_H.badgeRegister bg);
possibleSwitchTo (hd list)
od)
 2. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (?P478 ntfn nTFN list and (\<lambda>s. list \<noteq> [])) s
 3. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> ?Q'474 ntfn nTFN list s
 4. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (do y <- assert (list \<noteq> []);
y <- set_notification ep \<lparr>ntfn_obj = case drop (Suc 0) list of [] \<Rightarrow> Structures_A.ntfn.IdleNtfn | a # lista \<Rightarrow> Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr>;
y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 5. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (8 subgoals):
 1. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> ntfn_relation \<lparr>ntfn_obj = Structures_A.ntfn.IdleNtfn, ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr> (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) nTFN)
 2. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> corres dc (?R481 ntfn nTFN list rv) (?R'481 ntfn nTFN list y) (do y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (do y <- setThreadState Structures_H.thread_state.Running (hd list);
y <- asUser (hd list) (setRegister Notification_H.badgeRegister bg);
possibleSwitchTo (hd list)
od)
 3. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q481 ntfn nTFN list\<rbrace> set_notification ep \<lparr>ntfn_obj = Structures_A.ntfn.IdleNtfn, ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr> \<lbrace>?R481 ntfn nTFN list\<rbrace>
 4. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'481 ntfn nTFN list\<rbrace> setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) nTFN) \<lbrace>?R'481 ntfn nTFN list\<rbrace>
 5. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (ntfn_at ep and ?Q481 ntfn nTFN list and (\<lambda>s. list \<noteq> [])) s
 6. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (ntfn_at' ep and ?Q'481 ntfn nTFN list) s
 7. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (do y <- assert (list \<noteq> []);
y <- set_notification ep \<lparr>ntfn_obj = case drop (Suc 0) list of [] \<Rightarrow> Structures_A.ntfn.IdleNtfn | a # lista \<Rightarrow> Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr>;
y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 8. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (7 subgoals):
 1. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> corres dc (?R481 ntfn nTFN list rv) (?R'481 ntfn nTFN list y) (do y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (do y <- setThreadState Structures_H.thread_state.Running (hd list);
y <- asUser (hd list) (setRegister Notification_H.badgeRegister bg);
possibleSwitchTo (hd list)
od)
 2. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q481 ntfn nTFN list\<rbrace> set_notification ep \<lparr>ntfn_obj = Structures_A.ntfn.IdleNtfn, ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr> \<lbrace>?R481 ntfn nTFN list\<rbrace>
 3. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'481 ntfn nTFN list\<rbrace> setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) nTFN) \<lbrace>?R'481 ntfn nTFN list\<rbrace>
 4. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (ntfn_at ep and ?Q481 ntfn nTFN list and (\<lambda>s. list \<noteq> [])) s
 5. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (ntfn_at' ep and ?Q'481 ntfn nTFN list) s
 6. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (do y <- assert (list \<noteq> []);
y <- set_notification ep \<lparr>ntfn_obj = case drop (Suc 0) list of [] \<Rightarrow> Structures_A.ntfn.IdleNtfn | a # lista \<Rightarrow> Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr>;
y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 7. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (10 subgoals):
 1. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> thread_state_relation Structures_A.thread_state.Running Structures_H.thread_state.Running
 2. \<And>ntfn nTFN list rv y ya yb. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []; dc rv y; dc ya yb\<rbrakk> \<Longrightarrow> corres dc (?R487 ntfn nTFN list rv y ya) (?R'487 ntfn nTFN list rv y yb) (do y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (do y <- asUser (hd list) (setRegister Notification_H.badgeRegister bg);
possibleSwitchTo (hd list)
od)
 3. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> \<lbrace>?Q490 ntfn nTFN list rv\<rbrace> set_thread_state (hd list) Structures_A.thread_state.Running \<lbrace>?R487 ntfn nTFN list rv y\<rbrace>
 4. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'492 ntfn nTFN list y\<rbrace> setThreadState Structures_H.thread_state.Running (hd list) \<lbrace>?R'487 ntfn nTFN list rv y\<rbrace>
 5. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q481 ntfn nTFN list\<rbrace> set_notification ep \<lparr>ntfn_obj = Structures_A.ntfn.IdleNtfn, ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr> \<lbrace>\<lambda>rv. tcb_at (hd list) and ?Q490 ntfn nTFN list rv\<rbrace>
 6. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'481 ntfn nTFN list\<rbrace> setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) nTFN) \<lbrace>\<lambda>y. tcb_at' (hd list) and ?Q'492 ntfn nTFN list y\<rbrace>
 7. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (ntfn_at ep and ?Q481 ntfn nTFN list and (\<lambda>s. list \<noteq> [])) s
 8. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (ntfn_at' ep and ?Q'481 ntfn nTFN list) s
 9. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (do y <- assert (list \<noteq> []);
y <- set_notification ep \<lparr>ntfn_obj = case drop (Suc 0) list of [] \<Rightarrow> Structures_A.ntfn.IdleNtfn | a # lista \<Rightarrow> Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr>;
y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 10. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (9 subgoals):
 1. \<And>ntfn nTFN list rv y ya yb. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []; dc rv y; dc ya yb\<rbrakk> \<Longrightarrow> corres dc (?R487 ntfn nTFN list rv y ya) (?R'487 ntfn nTFN list rv y yb) (do y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (do y <- asUser (hd list) (setRegister Notification_H.badgeRegister bg);
possibleSwitchTo (hd list)
od)
 2. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> \<lbrace>?Q490 ntfn nTFN list rv\<rbrace> set_thread_state (hd list) Structures_A.thread_state.Running \<lbrace>?R487 ntfn nTFN list rv y\<rbrace>
 3. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'492 ntfn nTFN list y\<rbrace> setThreadState Structures_H.thread_state.Running (hd list) \<lbrace>?R'487 ntfn nTFN list rv y\<rbrace>
 4. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q481 ntfn nTFN list\<rbrace> set_notification ep \<lparr>ntfn_obj = Structures_A.ntfn.IdleNtfn, ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr> \<lbrace>\<lambda>rv. tcb_at (hd list) and ?Q490 ntfn nTFN list rv\<rbrace>
 5. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'481 ntfn nTFN list\<rbrace> setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) nTFN) \<lbrace>\<lambda>y. tcb_at' (hd list) and ?Q'492 ntfn nTFN list y\<rbrace>
 6. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (ntfn_at ep and ?Q481 ntfn nTFN list and (\<lambda>s. list \<noteq> [])) s
 7. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (ntfn_at' ep and ?Q'481 ntfn nTFN list) s
 8. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (do y <- assert (list \<noteq> []);
y <- set_notification ep \<lparr>ntfn_obj = case drop (Suc 0) list of [] \<Rightarrow> Structures_A.ntfn.IdleNtfn | a # lista \<Rightarrow> Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr>;
y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 9. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (9 subgoals):
 1. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (?R487 ntfn nTFN list () () ()) (?R'487 ntfn nTFN list () () ()) (do y <- as_user (hd list) (setRegister ARM.badgeRegister bg);
possible_switch_to (hd list)
od) (do y <- asUser (hd list) (setRegister ARM.badgeRegister bg);
possibleSwitchTo (hd list)
od)
 2. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> \<lbrace>?Q490 ntfn nTFN list rv\<rbrace> set_thread_state (hd list) Structures_A.thread_state.Running \<lbrace>?R487 ntfn nTFN list rv y\<rbrace>
 3. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'492 ntfn nTFN list y\<rbrace> setThreadState Structures_H.thread_state.Running (hd list) \<lbrace>?R'487 ntfn nTFN list rv y\<rbrace>
 4. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q481 ntfn nTFN list\<rbrace> set_notification ep \<lparr>ntfn_obj = Structures_A.ntfn.IdleNtfn, ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr> \<lbrace>\<lambda>rv. tcb_at (hd list) and ?Q490 ntfn nTFN list rv\<rbrace>
 5. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'481 ntfn nTFN list\<rbrace> setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) nTFN) \<lbrace>\<lambda>y. tcb_at' (hd list) and ?Q'492 ntfn nTFN list y\<rbrace>
 6. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (ntfn_at ep and ?Q481 ntfn nTFN list and (\<lambda>s. list \<noteq> [])) s
 7. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (ntfn_at' ep and ?Q'481 ntfn nTFN list) s
 8. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (do y <- assert (list \<noteq> []);
y <- set_notification ep \<lparr>ntfn_obj = case drop (Suc 0) list of [] \<Rightarrow> Structures_A.ntfn.IdleNtfn | a # lista \<Rightarrow> Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr>;
y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 9. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (11 subgoals):
 1. \<And>ntfn nTFN list y ya. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R497 ntfn nTFN list y) (?R'497 ntfn nTFN list ya) (possible_switch_to (hd list)) (possibleSwitchTo (hd list))
 2. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q502 ntfn nTFN list () () ()\<rbrace> as_user (hd list) (setRegister ARM.badgeRegister bg) \<lbrace>?R497 ntfn nTFN list\<rbrace>
 3. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'501 ntfn nTFN list () () ()\<rbrace> asUser (hd list) (setRegister ARM.badgeRegister bg) \<lbrace>?R'497 ntfn nTFN list\<rbrace>
 4. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> \<lbrace>?Q490 ntfn nTFN list rv\<rbrace> set_thread_state (hd list) Structures_A.thread_state.Running \<lbrace>\<lambda>a. tcb_at (hd list) and ?Q502 ntfn nTFN list rv y a\<rbrace>
 5. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'492 ntfn nTFN list y\<rbrace> setThreadState Structures_H.thread_state.Running (hd list) \<lbrace>\<lambda>a. tcb_at' (hd list) and ?Q'501 ntfn nTFN list rv y a\<rbrace>
 6. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q481 ntfn nTFN list\<rbrace> set_notification ep \<lparr>ntfn_obj = Structures_A.ntfn.IdleNtfn, ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr> \<lbrace>\<lambda>rv. tcb_at (hd list) and ?Q490 ntfn nTFN list rv\<rbrace>
 7. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'481 ntfn nTFN list\<rbrace> setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) nTFN) \<lbrace>\<lambda>y. tcb_at' (hd list) and ?Q'492 ntfn nTFN list y\<rbrace>
 8. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (ntfn_at ep and ?Q481 ntfn nTFN list and (\<lambda>s. list \<noteq> [])) s
 9. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (ntfn_at' ep and ?Q'481 ntfn nTFN list) s
 10. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (do y <- assert (list \<noteq> []);
y <- set_notification ep \<lparr>ntfn_obj = case drop (Suc 0) list of [] \<Rightarrow> Structures_A.ntfn.IdleNtfn | a # lista \<Rightarrow> Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr>;
y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q502 ntfn nTFN list () () ()\<rbrace> as_user (hd list) (setRegister ARM.badgeRegister bg) \<lbrace>\<lambda>y. valid_etcbs and weak_valid_sched_action and cur_tcb and st_tcb_at runnable (hd list)\<rbrace>
 2. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'501 ntfn nTFN list () () ()\<rbrace> asUser (hd list) (setRegister ARM.badgeRegister bg) \<lbrace>\<lambda>ya. Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and cur_tcb' and tcb_at' (hd list) and st_tcb_at' runnable' (hd list) and valid_objs'\<rbrace>
 3. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> \<lbrace>?Q490 ntfn nTFN list rv\<rbrace> set_thread_state (hd list) Structures_A.thread_state.Running \<lbrace>\<lambda>a. tcb_at (hd list) and ?Q502 ntfn nTFN list rv y a\<rbrace>
 4. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'492 ntfn nTFN list y\<rbrace> setThreadState Structures_H.thread_state.Running (hd list) \<lbrace>\<lambda>a. tcb_at' (hd list) and ?Q'501 ntfn nTFN list rv y a\<rbrace>
 5. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q481 ntfn nTFN list\<rbrace> set_notification ep \<lparr>ntfn_obj = Structures_A.ntfn.IdleNtfn, ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr> \<lbrace>\<lambda>rv. tcb_at (hd list) and ?Q490 ntfn nTFN list rv\<rbrace>
 6. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'481 ntfn nTFN list\<rbrace> setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) nTFN) \<lbrace>\<lambda>y. tcb_at' (hd list) and ?Q'492 ntfn nTFN list y\<rbrace>
 7. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (ntfn_at ep and ?Q481 ntfn nTFN list and (\<lambda>s. list \<noteq> [])) s
 8. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (ntfn_at' ep and ?Q'481 ntfn nTFN list) s
 9. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (do y <- assert (list \<noteq> []);
y <- set_notification ep \<lparr>ntfn_obj = case drop (Suc 0) list of [] \<Rightarrow> Structures_A.ntfn.IdleNtfn | a # lista \<Rightarrow> Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr>;
y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 10. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (9 subgoals):
 1. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'501 ntfn nTFN list () () ()\<rbrace> asUser (hd list) (setRegister ARM.badgeRegister bg) \<lbrace>\<lambda>ya. Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and cur_tcb' and tcb_at' (hd list) and st_tcb_at' runnable' (hd list) and valid_objs'\<rbrace>
 2. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> \<lbrace>?Q490 ntfn nTFN list rv\<rbrace> set_thread_state (hd list) Structures_A.thread_state.Running \<lbrace>\<lambda>a. tcb_at (hd list) and (\<lambda>a. valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a \<and> st_tcb_at runnable (hd list) a)\<rbrace>
 3. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'492 ntfn nTFN list y\<rbrace> setThreadState Structures_H.thread_state.Running (hd list) \<lbrace>\<lambda>a. tcb_at' (hd list) and ?Q'501 ntfn nTFN list rv y a\<rbrace>
 4. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q481 ntfn nTFN list\<rbrace> set_notification ep \<lparr>ntfn_obj = Structures_A.ntfn.IdleNtfn, ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr> \<lbrace>\<lambda>rv. tcb_at (hd list) and ?Q490 ntfn nTFN list rv\<rbrace>
 5. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'481 ntfn nTFN list\<rbrace> setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) nTFN) \<lbrace>\<lambda>y. tcb_at' (hd list) and ?Q'492 ntfn nTFN list y\<rbrace>
 6. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (ntfn_at ep and ?Q481 ntfn nTFN list and (\<lambda>s. list \<noteq> [])) s
 7. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (ntfn_at' ep and ?Q'481 ntfn nTFN list) s
 8. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (do y <- assert (list \<noteq> []);
y <- set_notification ep \<lparr>ntfn_obj = case drop (Suc 0) list of [] \<Rightarrow> Structures_A.ntfn.IdleNtfn | a # lista \<Rightarrow> Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr>;
y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 9. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (9 subgoals):
 1. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'501 ntfn nTFN list () () ()\<rbrace> asUser (hd list) (setRegister ARM.badgeRegister bg) \<lbrace>\<lambda>_. Invariants_H.valid_queues and valid_queues' and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s) and cur_tcb' and st_tcb_at' runnable' (hd list) and valid_objs'\<rbrace>
 2. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> \<lbrace>?Q490 ntfn nTFN list rv\<rbrace> set_thread_state (hd list) Structures_A.thread_state.Running \<lbrace>\<lambda>a. tcb_at (hd list) and (\<lambda>a. valid_etcbs a \<and> weak_valid_sched_action a \<and> cur_tcb a \<and> st_tcb_at runnable (hd list) a)\<rbrace>
 3. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'492 ntfn nTFN list y\<rbrace> setThreadState Structures_H.thread_state.Running (hd list) \<lbrace>\<lambda>a. tcb_at' (hd list) and ?Q'501 ntfn nTFN list rv y a\<rbrace>
 4. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q481 ntfn nTFN list\<rbrace> set_notification ep \<lparr>ntfn_obj = Structures_A.ntfn.IdleNtfn, ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr> \<lbrace>\<lambda>rv. tcb_at (hd list) and ?Q490 ntfn nTFN list rv\<rbrace>
 5. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'481 ntfn nTFN list\<rbrace> setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) nTFN) \<lbrace>\<lambda>y. tcb_at' (hd list) and ?Q'492 ntfn nTFN list y\<rbrace>
 6. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (ntfn_at ep and ?Q481 ntfn nTFN list and (\<lambda>s. list \<noteq> [])) s
 7. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (ntfn_at' ep and ?Q'481 ntfn nTFN list) s
 8. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (do y <- assert (list \<noteq> []);
y <- set_notification ep \<lparr>ntfn_obj = case drop (Suc 0) list of [] \<Rightarrow> Structures_A.ntfn.IdleNtfn | a # lista \<Rightarrow> Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr>;
y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 9. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (8 subgoals):
 1. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P'585 ntfn nTFN list ()\<rbrace> set_thread_state (hd list) Structures_A.thread_state.Running \<lbrace>\<lambda>rv s. weak_valid_sched_action s \<and> cur_tcb s \<and> st_tcb_at runnable (hd list) s\<rbrace>
 2. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'492 ntfn nTFN list y\<rbrace> setThreadState Structures_H.thread_state.Running (hd list) \<lbrace>\<lambda>a. tcb_at' (hd list) and (\<lambda>a. Invariants_H.valid_queues a \<and> valid_queues' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> cur_tcb' a \<and> st_tcb_at' runnable' (hd list) a \<and> valid_objs' a)\<rbrace>
 3. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q481 ntfn nTFN list\<rbrace> set_notification ep \<lparr>ntfn_obj = Structures_A.ntfn.IdleNtfn, ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr> \<lbrace>\<lambda>rv. tcb_at (hd list) and (\<lambda>s. tcb_at (hd list) s \<and> valid_etcbs s \<and> ?P'585 ntfn nTFN list rv s)\<rbrace>
 4. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'481 ntfn nTFN list\<rbrace> setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) nTFN) \<lbrace>\<lambda>y. tcb_at' (hd list) and ?Q'492 ntfn nTFN list y\<rbrace>
 5. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (ntfn_at ep and ?Q481 ntfn nTFN list and (\<lambda>s. list \<noteq> [])) s
 6. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (ntfn_at' ep and ?Q'481 ntfn nTFN list) s
 7. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (do y <- assert (list \<noteq> []);
y <- set_notification ep \<lparr>ntfn_obj = case drop (Suc 0) list of [] \<Rightarrow> Structures_A.ntfn.IdleNtfn | a # lista \<Rightarrow> Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr>;
y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 8. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (7 subgoals):
 1. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P'603 ntfn nTFN list ()\<rbrace> setThreadState Structures_H.thread_state.Running (hd list) \<lbrace>\<lambda>rv s. Invariants_H.valid_queues s \<and> valid_queues' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> st_tcb_at' runnable' (hd list) s \<and> valid_objs' s\<rbrace>
 2. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q481 ntfn nTFN list\<rbrace> set_notification ep \<lparr>ntfn_obj = Structures_A.ntfn.IdleNtfn, ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr> \<lbrace>\<lambda>rv. tcb_at (hd list) and (\<lambda>s. tcb_at (hd list) s \<and> valid_etcbs s \<and> (weak_valid_sched_action and (\<lambda>s. runnable Structures_A.thread_state.Running)) s \<and> cur_tcb s \<and> K (runnable Structures_A.thread_state.Running) s)\<rbrace>
 3. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'481 ntfn nTFN list\<rbrace> setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) nTFN) \<lbrace>\<lambda>y. tcb_at' (hd list) and (\<lambda>s. tcb_at' (hd list) s \<and> ?P'603 ntfn nTFN list y s)\<rbrace>
 4. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (ntfn_at ep and ?Q481 ntfn nTFN list and (\<lambda>s. list \<noteq> [])) s
 5. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (ntfn_at' ep and ?Q'481 ntfn nTFN list) s
 6. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (do y <- assert (list \<noteq> []);
y <- set_notification ep \<lparr>ntfn_obj = case drop (Suc 0) list of [] \<Rightarrow> Structures_A.ntfn.IdleNtfn | a # lista \<Rightarrow> Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr>;
y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 7. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (5 subgoals):
 1. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P'665 ntfn nTFN list\<rbrace> setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) nTFN) \<lbrace>\<lambda>rv s. valid_tcb_state' Structures_H.thread_state.Running s \<and> valid_objs' s\<rbrace>
 2. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (ntfn_at ep and (\<lambda>s. tcb_at (hd list) s \<and> tcb_at (hd list) s \<and> valid_etcbs s \<and> weak_valid_sched_action s \<and> runnable Structures_A.thread_state.Running \<and> cur_tcb s \<and> K (runnable Structures_A.thread_state.Running) s) and (\<lambda>s. list \<noteq> [])) s
 3. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (ntfn_at' ep and (\<lambda>s. tcb_at' (hd list) s \<and> tcb_at' (hd list) s \<and> Invariants_H.valid_queues s \<and> valid_queues' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' (hd list) s \<and> ?P'665 ntfn nTFN list s)) s
 4. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (do y <- assert (list \<noteq> []);
y <- set_notification ep \<lparr>ntfn_obj = case drop (Suc 0) list of [] \<Rightarrow> Structures_A.ntfn.IdleNtfn | a # lista \<Rightarrow> Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr>;
y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 5. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (4 subgoals):
 1. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; invs s \<and> valid_list s \<and> valid_sched s \<and> ntfn_at ep s \<and> valid_ntfn ntfn s \<and> ko_at (Notification ntfn) ep s\<rbrakk> \<Longrightarrow> tcb_at (hd list) s \<and> valid_etcbs s \<and> weak_valid_sched_action s \<and> cur_tcb s \<and> list \<noteq> []
 2. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (ntfn_at' ep and (\<lambda>s. tcb_at' (hd list) s \<and> tcb_at' (hd list) s \<and> Invariants_H.valid_queues s \<and> valid_queues' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' (hd list) s \<and> (valid_objs' and valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) nTFN)) s)) s
 3. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (do y <- assert (list \<noteq> []);
y <- set_notification ep \<lparr>ntfn_obj = case drop (Suc 0) list of [] \<Rightarrow> Structures_A.ntfn.IdleNtfn | a # lista \<Rightarrow> Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr>;
y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 4. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (3 subgoals):
 1. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list = []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (ntfn_at' ep and (\<lambda>s. tcb_at' (hd list) s \<and> tcb_at' (hd list) s \<and> Invariants_H.valid_queues s \<and> valid_queues' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' (hd list) s \<and> (valid_objs' and valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) nTFN)) s)) s
 2. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (do y <- assert (list \<noteq> []);
y <- set_notification ep \<lparr>ntfn_obj = case drop (Suc 0) list of [] \<Rightarrow> Structures_A.ntfn.IdleNtfn | a # lista \<Rightarrow> Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr>;
y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 3. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (3 subgoals):
 1. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; length list \<le> Suc 0; invs' s; ntfn_at' ep s; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; case ntfnBoundTCB nTFN of None \<Rightarrow> True | Some tcb \<Rightarrow> list = [tcb]; valid_bound_tcb' (ntfnBoundTCB nTFN) s; ko_at' nTFN ep s\<rbrakk> \<Longrightarrow> valid_queues' s
 2. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (do y <- assert (list \<noteq> []);
y <- set_notification ep \<lparr>ntfn_obj = case drop (Suc 0) list of [] \<Rightarrow> Structures_A.ntfn.IdleNtfn | a # lista \<Rightarrow> Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr>;
y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 3. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (2 subgoals):
 1. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (do y <- assert (list \<noteq> []);
y <- set_notification ep \<lparr>ntfn_obj = case drop (Suc 0) list of [] \<Rightarrow> Structures_A.ntfn.IdleNtfn | a # lista \<Rightarrow> Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr>;
y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 2. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (4 subgoals):
 1. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (?Q688 ntfn nTFN list) (?Q'688 ntfn nTFN list) (do y <- assert (list \<noteq> []);
y <- set_notification ep \<lparr>ntfn_obj = case drop (Suc 0) list of [] \<Rightarrow> Structures_A.ntfn.IdleNtfn | a # lista \<Rightarrow> Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr>;
y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 2. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> ?Q688 ntfn nTFN list s
 3. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> ?Q'688 ntfn nTFN list s
 4. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (4 subgoals):
 1. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []; list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (?P692 ntfn nTFN list) (?Q'688 ntfn nTFN list) (do y <- assert (list \<noteq> []);
y <- set_notification ep \<lparr>ntfn_obj = case drop (Suc 0) list of [] \<Rightarrow> Structures_A.ntfn.IdleNtfn | a # lista \<Rightarrow> Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr>;
y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od)
 2. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (?P692 ntfn nTFN list and (\<lambda>s. list \<noteq> [])) s
 3. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> ?Q'688 ntfn nTFN list s
 4. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (4 subgoals):
 1. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (?P692 ntfn nTFN list) (?Q'688 ntfn nTFN list) (do y <- set_notification ep \<lparr>ntfn_obj = Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr>;
y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (do y <- setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (drop (Suc 0) list)) nTFN);
y <- setThreadState Structures_H.thread_state.Running (hd list);
y <- asUser (hd list) (setRegister Notification_H.badgeRegister bg);
possibleSwitchTo (hd list)
od)
 2. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (?P692 ntfn nTFN list and (\<lambda>s. list \<noteq> [])) s
 3. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> ?Q'688 ntfn nTFN list s
 4. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (7 subgoals):
 1. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> ntfn_relation \<lparr>ntfn_obj = Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr> (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (drop (Suc 0) list)) nTFN)
 2. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> corres dc (?R693 ntfn nTFN list rv) (?R'693 ntfn nTFN list y) (do y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (do y <- setThreadState Structures_H.thread_state.Running (hd list);
y <- asUser (hd list) (setRegister Notification_H.badgeRegister bg);
possibleSwitchTo (hd list)
od)
 3. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q693 ntfn nTFN list\<rbrace> set_notification ep \<lparr>ntfn_obj = Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr> \<lbrace>?R693 ntfn nTFN list\<rbrace>
 4. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'693 ntfn nTFN list\<rbrace> setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (drop (Suc 0) list)) nTFN) \<lbrace>?R'693 ntfn nTFN list\<rbrace>
 5. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (ntfn_at ep and ?Q693 ntfn nTFN list and (\<lambda>s. list \<noteq> [])) s
 6. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (ntfn_at' ep and ?Q'693 ntfn nTFN list) s
 7. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (6 subgoals):
 1. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> corres dc (?R693 ntfn nTFN list rv) (?R'693 ntfn nTFN list y) (do y <- set_thread_state (hd list) Structures_A.thread_state.Running;
y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (do y <- setThreadState Structures_H.thread_state.Running (hd list);
y <- asUser (hd list) (setRegister Notification_H.badgeRegister bg);
possibleSwitchTo (hd list)
od)
 2. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q693 ntfn nTFN list\<rbrace> set_notification ep \<lparr>ntfn_obj = Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr> \<lbrace>?R693 ntfn nTFN list\<rbrace>
 3. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'693 ntfn nTFN list\<rbrace> setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (drop (Suc 0) list)) nTFN) \<lbrace>?R'693 ntfn nTFN list\<rbrace>
 4. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (ntfn_at ep and ?Q693 ntfn nTFN list and (\<lambda>s. list \<noteq> [])) s
 5. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (ntfn_at' ep and ?Q'693 ntfn nTFN list) s
 6. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (9 subgoals):
 1. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> thread_state_relation Structures_A.thread_state.Running Structures_H.thread_state.Running
 2. \<And>ntfn nTFN list rv y ya yb. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []; dc rv y; dc ya yb\<rbrakk> \<Longrightarrow> corres dc (?R699 ntfn nTFN list rv y ya) (?R'699 ntfn nTFN list rv y yb) (do y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (do y <- asUser (hd list) (setRegister Notification_H.badgeRegister bg);
possibleSwitchTo (hd list)
od)
 3. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> \<lbrace>?Q702 ntfn nTFN list rv\<rbrace> set_thread_state (hd list) Structures_A.thread_state.Running \<lbrace>?R699 ntfn nTFN list rv y\<rbrace>
 4. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'704 ntfn nTFN list y\<rbrace> setThreadState Structures_H.thread_state.Running (hd list) \<lbrace>?R'699 ntfn nTFN list rv y\<rbrace>
 5. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q693 ntfn nTFN list\<rbrace> set_notification ep \<lparr>ntfn_obj = Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr> \<lbrace>\<lambda>rv. tcb_at (hd list) and ?Q702 ntfn nTFN list rv\<rbrace>
 6. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'693 ntfn nTFN list\<rbrace> setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (drop (Suc 0) list)) nTFN) \<lbrace>\<lambda>y. tcb_at' (hd list) and ?Q'704 ntfn nTFN list y\<rbrace>
 7. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (ntfn_at ep and ?Q693 ntfn nTFN list and (\<lambda>s. list \<noteq> [])) s
 8. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (ntfn_at' ep and ?Q'693 ntfn nTFN list) s
 9. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (8 subgoals):
 1. \<And>ntfn nTFN list rv y ya yb. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []; dc rv y; dc ya yb\<rbrakk> \<Longrightarrow> corres dc (?R699 ntfn nTFN list rv y ya) (?R'699 ntfn nTFN list rv y yb) (do y <- as_user (hd list) (setRegister badge_register bg);
possible_switch_to (hd list)
od) (do y <- asUser (hd list) (setRegister Notification_H.badgeRegister bg);
possibleSwitchTo (hd list)
od)
 2. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> \<lbrace>?Q702 ntfn nTFN list rv\<rbrace> set_thread_state (hd list) Structures_A.thread_state.Running \<lbrace>?R699 ntfn nTFN list rv y\<rbrace>
 3. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'704 ntfn nTFN list y\<rbrace> setThreadState Structures_H.thread_state.Running (hd list) \<lbrace>?R'699 ntfn nTFN list rv y\<rbrace>
 4. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q693 ntfn nTFN list\<rbrace> set_notification ep \<lparr>ntfn_obj = Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr> \<lbrace>\<lambda>rv. tcb_at (hd list) and ?Q702 ntfn nTFN list rv\<rbrace>
 5. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'693 ntfn nTFN list\<rbrace> setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (drop (Suc 0) list)) nTFN) \<lbrace>\<lambda>y. tcb_at' (hd list) and ?Q'704 ntfn nTFN list y\<rbrace>
 6. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (ntfn_at ep and ?Q693 ntfn nTFN list and (\<lambda>s. list \<noteq> [])) s
 7. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (ntfn_at' ep and ?Q'693 ntfn nTFN list) s
 8. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (8 subgoals):
 1. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (?R699 ntfn nTFN list () () ()) (?R'699 ntfn nTFN list () () ()) (do y <- as_user (hd list) (setRegister ARM.badgeRegister bg);
possible_switch_to (hd list)
od) (do y <- asUser (hd list) (setRegister ARM.badgeRegister bg);
possibleSwitchTo (hd list)
od)
 2. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> \<lbrace>?Q702 ntfn nTFN list rv\<rbrace> set_thread_state (hd list) Structures_A.thread_state.Running \<lbrace>?R699 ntfn nTFN list rv y\<rbrace>
 3. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'704 ntfn nTFN list y\<rbrace> setThreadState Structures_H.thread_state.Running (hd list) \<lbrace>?R'699 ntfn nTFN list rv y\<rbrace>
 4. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q693 ntfn nTFN list\<rbrace> set_notification ep \<lparr>ntfn_obj = Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr> \<lbrace>\<lambda>rv. tcb_at (hd list) and ?Q702 ntfn nTFN list rv\<rbrace>
 5. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'693 ntfn nTFN list\<rbrace> setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (drop (Suc 0) list)) nTFN) \<lbrace>\<lambda>y. tcb_at' (hd list) and ?Q'704 ntfn nTFN list y\<rbrace>
 6. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (ntfn_at ep and ?Q693 ntfn nTFN list and (\<lambda>s. list \<noteq> [])) s
 7. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (ntfn_at' ep and ?Q'693 ntfn nTFN list) s
 8. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (10 subgoals):
 1. \<And>ntfn nTFN list y ya. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R709 ntfn nTFN list y) (?R'709 ntfn nTFN list ya) (possible_switch_to (hd list)) (possibleSwitchTo (hd list))
 2. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q714 ntfn nTFN list () () ()\<rbrace> as_user (hd list) (setRegister ARM.badgeRegister bg) \<lbrace>?R709 ntfn nTFN list\<rbrace>
 3. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'713 ntfn nTFN list () () ()\<rbrace> asUser (hd list) (setRegister ARM.badgeRegister bg) \<lbrace>?R'709 ntfn nTFN list\<rbrace>
 4. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> \<lbrace>?Q702 ntfn nTFN list rv\<rbrace> set_thread_state (hd list) Structures_A.thread_state.Running \<lbrace>\<lambda>a. tcb_at (hd list) and ?Q714 ntfn nTFN list rv y a\<rbrace>
 5. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'704 ntfn nTFN list y\<rbrace> setThreadState Structures_H.thread_state.Running (hd list) \<lbrace>\<lambda>a. tcb_at' (hd list) and ?Q'713 ntfn nTFN list rv y a\<rbrace>
 6. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q693 ntfn nTFN list\<rbrace> set_notification ep \<lparr>ntfn_obj = Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr> \<lbrace>\<lambda>rv. tcb_at (hd list) and ?Q702 ntfn nTFN list rv\<rbrace>
 7. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'693 ntfn nTFN list\<rbrace> setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (drop (Suc 0) list)) nTFN) \<lbrace>\<lambda>y. tcb_at' (hd list) and ?Q'704 ntfn nTFN list y\<rbrace>
 8. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (ntfn_at ep and ?Q693 ntfn nTFN list and (\<lambda>s. list \<noteq> [])) s
 9. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (ntfn_at' ep and ?Q'693 ntfn nTFN list) s
 10. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (9 subgoals):
 1. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q714 ntfn nTFN list () () ()\<rbrace> as_user (hd list) (setRegister ARM.badgeRegister bg) \<lbrace>\<lambda>y. valid_etcbs and weak_valid_sched_action and cur_tcb and st_tcb_at runnable (hd list)\<rbrace>
 2. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'713 ntfn nTFN list () () ()\<rbrace> asUser (hd list) (setRegister ARM.badgeRegister bg) \<lbrace>\<lambda>ya. Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and cur_tcb' and tcb_at' (hd list) and st_tcb_at' runnable' (hd list) and valid_objs'\<rbrace>
 3. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> \<lbrace>?Q702 ntfn nTFN list rv\<rbrace> set_thread_state (hd list) Structures_A.thread_state.Running \<lbrace>\<lambda>a. tcb_at (hd list) and ?Q714 ntfn nTFN list rv y a\<rbrace>
 4. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'704 ntfn nTFN list y\<rbrace> setThreadState Structures_H.thread_state.Running (hd list) \<lbrace>\<lambda>a. tcb_at' (hd list) and ?Q'713 ntfn nTFN list rv y a\<rbrace>
 5. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q693 ntfn nTFN list\<rbrace> set_notification ep \<lparr>ntfn_obj = Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr> \<lbrace>\<lambda>rv. tcb_at (hd list) and ?Q702 ntfn nTFN list rv\<rbrace>
 6. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'693 ntfn nTFN list\<rbrace> setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (drop (Suc 0) list)) nTFN) \<lbrace>\<lambda>y. tcb_at' (hd list) and ?Q'704 ntfn nTFN list y\<rbrace>
 7. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (ntfn_at ep and ?Q693 ntfn nTFN list and (\<lambda>s. list \<noteq> [])) s
 8. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (ntfn_at' ep and ?Q'693 ntfn nTFN list) s
 9. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (7 subgoals):
 1. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P'797 ntfn nTFN list ()\<rbrace> set_thread_state (hd list) Structures_A.thread_state.Running \<lbrace>\<lambda>rv s. weak_valid_sched_action s \<and> cur_tcb s \<and> st_tcb_at runnable (hd list) s\<rbrace>
 2. \<And>ntfn nTFN list rv y. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []; dc rv y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'704 ntfn nTFN list y\<rbrace> setThreadState Structures_H.thread_state.Running (hd list) \<lbrace>\<lambda>a. tcb_at' (hd list) and (\<lambda>a. Invariants_H.valid_queues a \<and> valid_queues' a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> cur_tcb' a \<and> tcb_at' (hd list) a \<and> st_tcb_at' runnable' (hd list) a \<and> valid_objs' a)\<rbrace>
 3. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q693 ntfn nTFN list\<rbrace> set_notification ep \<lparr>ntfn_obj = Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr> \<lbrace>\<lambda>rv. tcb_at (hd list) and (\<lambda>s. tcb_at (hd list) s \<and> valid_etcbs s \<and> ?P'797 ntfn nTFN list rv s)\<rbrace>
 4. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'693 ntfn nTFN list\<rbrace> setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (drop (Suc 0) list)) nTFN) \<lbrace>\<lambda>y. tcb_at' (hd list) and ?Q'704 ntfn nTFN list y\<rbrace>
 5. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (ntfn_at ep and ?Q693 ntfn nTFN list and (\<lambda>s. list \<noteq> [])) s
 6. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (ntfn_at' ep and ?Q'693 ntfn nTFN list) s
 7. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (6 subgoals):
 1. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P'815 ntfn nTFN list ()\<rbrace> setThreadState Structures_H.thread_state.Running (hd list) \<lbrace>\<lambda>rv s. Invariants_H.valid_queues s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' (hd list) s \<and> st_tcb_at' runnable' (hd list) s \<and> valid_objs' s\<rbrace>
 2. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q693 ntfn nTFN list\<rbrace> set_notification ep \<lparr>ntfn_obj = Structures_A.ntfn.WaitingNtfn (drop (Suc 0) list), ntfn_bound_tcb = ntfnBoundTCB nTFN\<rparr> \<lbrace>\<lambda>rv. tcb_at (hd list) and (\<lambda>s. tcb_at (hd list) s \<and> valid_etcbs s \<and> (weak_valid_sched_action and (\<lambda>s. runnable Structures_A.thread_state.Running)) s \<and> cur_tcb s \<and> K (runnable Structures_A.thread_state.Running) s)\<rbrace>
 3. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'693 ntfn nTFN list\<rbrace> setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (drop (Suc 0) list)) nTFN) \<lbrace>\<lambda>y. tcb_at' (hd list) and (\<lambda>s. tcb_at' (hd list) s \<and> ?P'815 ntfn nTFN list y s)\<rbrace>
 4. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (ntfn_at ep and ?Q693 ntfn nTFN list and (\<lambda>s. list \<noteq> [])) s
 5. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (ntfn_at' ep and ?Q'693 ntfn nTFN list) s
 6. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (4 subgoals):
 1. \<And>ntfn nTFN list. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; list \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P'881 ntfn nTFN list\<rbrace> setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (drop (Suc 0) list)) nTFN) \<lbrace>\<lambda>rv s. valid_tcb_state' Structures_H.thread_state.Running s \<and> valid_objs' s\<rbrace>
 2. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> (ntfn_at ep and (\<lambda>s. tcb_at (hd list) s \<and> tcb_at (hd list) s \<and> valid_etcbs s \<and> weak_valid_sched_action s \<and> runnable Structures_A.thread_state.Running \<and> cur_tcb s \<and> K (runnable Structures_A.thread_state.Running) s) and (\<lambda>s. list \<noteq> [])) s
 3. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (ntfn_at' ep and (\<lambda>s. tcb_at' (hd list) s \<and> tcb_at' (hd list) s \<and> Invariants_H.valid_queues s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' (hd list) s \<and> ?P'881 ntfn nTFN list s)) s
 4. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (3 subgoals):
 1. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; \<not> length list \<le> Suc 0; invs s \<and> valid_list s \<and> valid_sched s \<and> ntfn_at ep s \<and> valid_ntfn ntfn s \<and> ko_at (Notification ntfn) ep s\<rbrakk> \<Longrightarrow> tcb_at (hd list) s \<and> valid_etcbs s \<and> weak_valid_sched_action s \<and> cur_tcb s \<and> list \<noteq> []
 2. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (ntfn_at' ep and (\<lambda>s. tcb_at' (hd list) s \<and> tcb_at' (hd list) s \<and> Invariants_H.valid_queues s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' (hd list) s \<and> (valid_objs' and valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (drop (Suc 0) list)) nTFN)) s)) s
 3. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (2 subgoals):
 1. \<And>ntfn nTFN list s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.WaitingNtfn list; ntfnObj nTFN = Structures_H.ntfn.WaitingNtfn list; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; tl list \<noteq> []; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> (ntfn_at' ep and (\<lambda>s. tcb_at' (hd list) s \<and> tcb_at' (hd list) s \<and> Invariants_H.valid_queues s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' (hd list) s \<and> (valid_objs' and valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (drop (Suc 0) list)) nTFN)) s)) s
 2. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (1 subgoal):
 1. \<And>ntfn nTFN x3. \<lbrakk>ntfn_relation ntfn nTFN; ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (case ntfn_obj ntfn of Structures_A.ntfn.IdleNtfn \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg) | Some tcb \<Rightarrow> do st <- get_thread_state tcb;
if receive_blocked st then do cancel_ipc tcb;
set_thread_state tcb Structures_A.thread_state.Running;
as_user tcb $ setRegister badge_register bg;
do_extended_op (possible_switch_to tcb)
od else set_notification ep $ ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn bg)
od | Structures_A.ntfn.WaitingNtfn queue \<Rightarrow> update_waiting_ntfn ep queue (ntfn_bound_tcb ntfn) bg | Structures_A.ntfn.ActiveNtfn badge' \<Rightarrow> set_notification ep $ ntfn_set_obj ntfn $ Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg badge')) (case ntfnObj nTFN of Structures_H.ntfn.IdleNtfn \<Rightarrow> case ntfnBoundTCB nTFN of None \<Rightarrow> setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN | Some tcb \<Rightarrow> do state <- getThreadState tcb;
if receiveBlocked state then do cancelIPC tcb;
setThreadState Structures_H.thread_state.Running tcb;
asUser tcb $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo tcb
od else setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn bg) nTFN
od | Structures_H.ntfn.ActiveNtfn badge' \<Rightarrow> do newBadge <- return (bg || badge');
setNotification ep $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn newBadge) nTFN
od | Structures_H.ntfn.WaitingNtfn [] \<Rightarrow> haskell_fail [] | Structures_H.ntfn.WaitingNtfn (dest # queue) \<Rightarrow> do setNotification ep $ ntfnObj_update (\<lambda>_. case queue of [] \<Rightarrow> Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> Structures_H.ntfn.WaitingNtfn queue) nTFN;
setThreadState Structures_H.thread_state.Running dest;
asUser dest $ setRegister Notification_H.badgeRegister bg;
possibleSwitchTo dest
od) proof (prove)
goal (1 subgoal):
 1. \<And>ntfn nTFN x3. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3; ntfnObj nTFN = Structures_H.ntfn.ActiveNtfn x3; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN\<rbrakk> \<Longrightarrow> corres dc (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) (set_notification ep (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg x3)))) (setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn (bg || x3)) nTFN)) proof (prove)
goal (3 subgoals):
 1. \<And>ntfn nTFN x3. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3; ntfnObj nTFN = Structures_H.ntfn.ActiveNtfn x3; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN\<rbrakk> \<Longrightarrow> corres dc (?Q953 ntfn nTFN x3) (?Q'953 ntfn nTFN x3) (set_notification ep (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg x3)))) (setNotification ep (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn (bg || x3)) nTFN))
 2. \<And>ntfn nTFN x3 s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3; ntfnObj nTFN = Structures_H.ntfn.ActiveNtfn x3; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> ?Q953 ntfn nTFN x3 s
 3. \<And>ntfn nTFN x3 s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3; ntfnObj nTFN = Structures_H.ntfn.ActiveNtfn x3; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> ?Q'953 ntfn nTFN x3 s proof (prove)
goal (3 subgoals):
 1. \<And>ntfn nTFN x3. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3; ntfnObj nTFN = Structures_H.ntfn.ActiveNtfn x3; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN\<rbrakk> \<Longrightarrow> ntfn_relation (ntfn_set_obj ntfn (Structures_A.ntfn.ActiveNtfn (combine_ntfn_badges bg x3))) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.ActiveNtfn (bg || x3)) nTFN)
 2. \<And>ntfn nTFN x3 s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3; ntfnObj nTFN = Structures_H.ntfn.ActiveNtfn x3; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> ntfn_at ep s
 3. \<And>ntfn nTFN x3 s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3; ntfnObj nTFN = Structures_H.ntfn.ActiveNtfn x3; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> ntfn_at' ep s proof (prove)
goal (2 subgoals):
 1. \<And>ntfn nTFN x3 s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3; ntfnObj nTFN = Structures_H.ntfn.ActiveNtfn x3; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; (einvs and ntfn_at ep and valid_ntfn ntfn and ko_at (Notification ntfn) ep) s\<rbrakk> \<Longrightarrow> ntfn_at ep s
 2. \<And>ntfn nTFN x3 s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3; ntfnObj nTFN = Structures_H.ntfn.ActiveNtfn x3; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> ntfn_at' ep s proof (prove)
goal (1 subgoal):
 1. \<And>ntfn nTFN x3 s. \<lbrakk>ntfn_obj ntfn = Structures_A.ntfn.ActiveNtfn x3; ntfnObj nTFN = Structures_H.ntfn.ActiveNtfn x3; ntfn_bound_tcb ntfn = ntfnBoundTCB nTFN; (invs' and ntfn_at' ep and valid_ntfn' nTFN and ko_at' nTFN ep) s\<rbrakk> \<Longrightarrow> ntfn_at' ep s proof (prove)
goal:
No subgoals!